Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Read More

Detects blocked load attempts of revoked drivers

Read More

Detects blocked image load events with revoked certificates by code integrity.

Read More

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More

Detects block events for files that are disallowed by code integrity for protected processes

Read More

Detects image load events with revoked certificates by code integrity.

Read More

Detects the load of a revoked kernel driver

Read More

Detects loaded kernel modules that did not meet the WHQL signing requirements.

Read More

Detects loaded unsigned image on the system

Read More

Detects the presence of a loaded unsigned kernel module on the system.

Read More