{"id":"470ec5fa-7b4e-4071-b200-4c753100f49b","title":"Failed Code Integrity Checks","description":"Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.\n","author":"Thomas Patzke","status":"stable","level":"informational","date":"2019-12-03","modified":"2025-01-19","tags":["attack.stealth","attack.t1027.001"],"technique_ids":["T1027.001"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Disk device errors"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281"],"source_path":"rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml","source_sha256":"fbe43e46701a13a2a9c8e1c16915875f241e1de62ddb0b7d15d0563cc6d3af8e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Failed Code Integrity Checks\nid: 470ec5fa-7b4e-4071-b200-4c753100f49b\nstatus: stable\ndescription: |\n    Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281\nauthor: Thomas Patzke\ndate: 2019-12-03\nmodified: 2025-01-19\ntags:\n    - attack.stealth\n    - attack.t1027.001\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID:\n            - 5038\n            - 6281\n    filter_optional_crowdstrike:\n        param1|contains:\n            - '\\CSFalconServiceUninstallTool_'\n            - '\\Program Files\\CrowdStrike\\'\n            - '\\System32\\drivers\\CrowdStrike\\'\n            - '\\Windows\\System32\\ScriptControl64_'\n    filter_optional_sophos:\n        param1|contains: '\\Program Files\\Sophos\\'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Disk device errors\nlevel: informational\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.001","id":"T1027.001","name":"Binary Padding","page":"techniques/enterprise/T1027.001/"}],"data_path":"data/detection-rules/470ec5fa-7b4e-4071-b200-4c753100f49b.json","kind":"sigma"}