Windows Security: Failed Code Integrity Checks (Event IDs 5038 and 6281)

title: "Windows Security: Failed Code Integrity Checks (Event IDs 5038 and 6281)"
id: 5a55f0c4-2d01-4f9f-b4a3-607bbbfdae64
status: stable
description: This rule flags Windows Security events indicating failed code integrity checks, including missing page hashes or corrupted drivers. Such failures can occur when binaries are modified or otherwise fail integrity validation, which may indicate tampering. It relies on Security log telemetry for Event IDs 5038 and 6281 and excludes certain paths associated with CrowdStrike and Sophos installs.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-03
modified: 2025-01-19
tags:
  - attack.stealth
  - attack.t1027.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 5038
      - 6281
  filter_optional_crowdstrike:
    param1|contains:
      - \CSFalconServiceUninstallTool_
      - \Program Files\CrowdStrike\
      - \System32\drivers\CrowdStrike\
      - \Windows\System32\ScriptControl64_
  filter_optional_sophos:
    param1|contains: \Program Files\Sophos\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Disk device errors
level: informational
license: DRL-1.1
related:
  - id: 470ec5fa-7b4e-4071-b200-4c753100f49b
    type: derived