Failed Code Integrity Checks
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
Sigma rule (View on GitHub)
1title: Failed Code Integrity Checks
2id: 470ec5fa-7b4e-4071-b200-4c753100f49b
3status: stable
4description: |
5 Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
6references:
7 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5038
8 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6281
9author: Thomas Patzke
10date: 2019/12/03
11modified: 2023/12/13
12tags:
13 - attack.defense_evasion
14 - attack.t1027.001
15logsource:
16 product: windows
17 service: security
18detection:
19 selection:
20 EventID:
21 - 5038
22 - 6281
23 condition: selection
24falsepositives:
25 - Disk device errors
26level: informational
References
Related rules
- Binary Padding - MacOS
- Binary Padding - Linux
- AWS Config Disabling Channel/Recorder
- Bitsadmin to Uncommon IP Server Address
- Cisco Clear Logs