code-integrity.json

{
  "dataset": {
    "name": "EID Quick Reference - Code Integrity",
    "version": "1.5.0",
    "generatedAt": "2026-05-10T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/code-integrity.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 3001,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "Unsigned kernel module loaded",
      "summary": "An unsigned or untrusted kernel module was detected loading.",
      "details": "Generated when the Windows Code Integrity component detects that a kernel module (driver) that does not meet signing requirements has been loaded. This event does not necessarily mean the load was blocked -- it indicates detection. It is the primary detection signal for Bring Your Own Vulnerable Driver (BYOVD) attacks, where adversaries load a signed but vulnerable driver to exploit it for privilege escalation or to disable security tools.",
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "unsigned-driver",
        "byovd",
        "privilege-escalation",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3033,
          "log": "CodeIntegrity"
        },
        {
          "id": 3034,
          "log": "CodeIntegrity"
        },
        {
          "id": 6,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1068",
          "techniqueName": "Exploitation for Privilege Escalation",
          "tactics": [
            {
              "tacticId": "TA0004",
              "tacticName": "Privilege Escalation"
            }
          ]
        },
        {
          "techniqueId": "T1685",
          "techniqueName": "Disable or Modify Tools",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Hash the FileName and check against LOLDrivers (loldrivers.io) and VirusTotal",
          "Review the driver's digital signature — a signed but known-vulnerable driver is a BYOVD indicator",
          "Correlate with Sysmon EID 6 (driver load) for additional context including hash and signature details",
          "Check for NtLoadDriver or ZwLoadDriver API calls in process activity near the event timestamp"
        ],
        "commonFalsePositives": [
          "Legacy third-party drivers that predate mandatory kernel signing requirements (test-signed or older drivers)",
          "Kernel debugging environments with test signing mode enabled"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the kernel module that was detected loading"
        },
        {
          "name": "ProcessNameBuffer",
          "xpath": "EventData/Data[@Name='ProcessNameBuffer']",
          "description": "Process that attempted to load the kernel module"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3003,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "File integrity check failed",
      "summary": "Code Integrity could not verify the integrity of a file.",
      "details": "Generated when Code Integrity is unable to verify the integrity of a file (e.g., due to a missing or inaccessible catalog, corrupted signature, or hash mismatch). This event differs from EID 3033 (policy block) in that it indicates a verification failure rather than a policy decision. File integrity check failures on system binaries or security tools may indicate tampering, binary replacement, or in-memory patching.",
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "integrity-check",
        "tamper",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3001,
          "log": "CodeIntegrity"
        },
        {
          "id": 3004,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.002",
          "techniqueName": "Subvert Trust Controls: Code Signing",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Hash FileName and compare against known-good file hashes from the vendor or Microsoft",
          "Check whether the catalog (.cat) file referenced in the error is present and unmodified",
          "Investigate whether the failure is isolated to one file or systemic across multiple binaries"
        ],
        "commonFalsePositives": [
          "Incomplete software installation where catalog files have not yet been updated",
          "Corrupted Windows Update leaving some files with mismatched catalog entries"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file that failed integrity verification"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3004,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "File hash not found in trusted catalog",
      "summary": "The hash of a file was not found in any trusted catalog.",
      "details": "Generated when Code Integrity cannot find the hash of a file in any trusted catalog file (.cat), meaning the file cannot be verified as genuine. Unlike a signature failure, this indicates the file is not catalogued at all -- it may be a novel file, a renamed legitimate binary, or a file from a software package whose catalog has not been installed. This event is commonly seen with user-mode binaries in WDAC enforcement environments. For kernel-mode drivers, it is a strong indicator the driver is not part of any trusted package.",
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "catalog",
        "unsigned",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3003,
          "log": "CodeIntegrity"
        },
        {
          "id": 3033,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.002",
          "techniqueName": "Subvert Trust Controls: Code Signing",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Check FileName path — files in user-writable directories (AppData, Temp, Downloads) are high priority",
          "Submit the file hash to VirusTotal or an internal threat intelligence platform",
          "Correlate with process creation events to determine what process loaded the uncatalogued file"
        ],
        "commonFalsePositives": [
          "Internal or custom software built in-house without catalog signing",
          "Developer tools and test binaries not included in any published catalog"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file whose hash was not found in any trusted catalog"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3033,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "Code Integrity blocked unsigned file (enforcement)",
      "summary": "Code Integrity blocked a file from loading because it did not meet signing level requirements.",
      "details": "Generated when Code Integrity actively blocks a file from loading because it does not meet the required signing level. This is the enforcement-mode counterpart to EID 3034 (audit). This event fires for both kernel-mode (driver) and user-mode (DLL/EXE) blocks depending on the active policy. For BYOVD scenarios, a block on a kernel driver indicates the system prevented an unsigned or improperly signed driver load.",
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "unsigned-blocked",
        "byovd",
        "wdac",
        "defense-evasion",
        "privilege-escalation"
      ],
      "relatedEventIds": [
        {
          "id": 3001,
          "log": "CodeIntegrity"
        },
        {
          "id": 3034,
          "log": "CodeIntegrity"
        },
        {
          "id": 3077,
          "log": "CodeIntegrity"
        },
        {
          "id": 6,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1068",
          "techniqueName": "Exploitation for Privilege Escalation",
          "tactics": [
            {
              "tacticId": "TA0004",
              "tacticName": "Privilege Escalation"
            }
          ]
        },
        {
          "techniqueId": "T1553.006",
          "techniqueName": "Subvert Trust Controls: Code Signing Policy Modification",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "FileName is the primary pivot — check against LOLDrivers and hash against threat intel",
          "ProcessNameBuffer identifies the process attempting the load — unexpected loaders (non-system processes) are suspicious",
          "If this event repeats for the same file, the attacker may be retrying after each failure — watch for persistence mechanisms"
        ],
        "commonFalsePositives": [
          "Third-party software deploying drivers that have not been signed with the appropriate kernel signing certificate",
          "Development or test environments where drivers are built locally without valid signatures"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file that was blocked from loading"
        },
        {
          "name": "ProcessNameBuffer",
          "xpath": "EventData/Data[@Name='ProcessNameBuffer']",
          "description": "Process that attempted to load the blocked file"
        },
        {
          "name": "RequestedPolicy",
          "xpath": "EventData/Data[@Name='RequestedPolicy']",
          "description": "The signing level required by the active policy"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3034,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Information",
      "title": "Code Integrity audit: file would have been blocked",
      "summary": "In audit mode, Code Integrity detected a file that would have been blocked under enforcement.",
      "details": "Generated in audit mode (WDAC policy set to Audit Only) when Code Integrity detects a file that would have been blocked if enforcement were active. This event is used during WDAC policy deployment to identify what would break before switching to enforcement mode. Unlike EID 3033, the file load was permitted because enforcement was not active.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "A Windows Defender Application Control (WDAC) policy must be deployed and active in audit mode for this event to be generated."
        }
      ],
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "audit-mode",
        "wdac",
        "unsigned",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3033,
          "log": "CodeIntegrity"
        },
        {
          "id": 3001,
          "log": "CodeIntegrity"
        },
        {
          "id": 3076,
          "log": "CodeIntegrity"
        },
        {
          "id": 6,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1068",
          "techniqueName": "Exploitation for Privilege Escalation",
          "tactics": [
            {
              "tacticId": "TA0004",
              "tacticName": "Privilege Escalation"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Treat this event identically to EID 3033 from a threat hunting perspective — the load was permitted",
          "Identify whether this host is intentionally in audit mode or if audit mode represents a misconfiguration",
          "Use FileName to determine whether the loaded file was malicious"
        ],
        "commonFalsePositives": [
          "Any unsigned file on a system in WDAC audit mode — volume is expected during policy baseline development",
          "Internally developed software not yet added to the WDAC allow list"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file that would have been blocked under enforcement"
        },
        {
          "name": "ProcessNameBuffer",
          "xpath": "EventData/Data[@Name='ProcessNameBuffer']",
          "description": "Process that loaded the file"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-10"
    },
    {
      "id": 3036,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "WHQL policy violation",
      "summary": "A file failed the Windows Hardware Quality Labs signing policy check.",
      "details": "Generated when a kernel-mode driver fails the WHQL (Windows Hardware Quality Labs) signing enforcement check. WHQL signing is required for kernel drivers on Windows and indicates the driver has passed Microsoft hardware certification. A WHQL policy violation means the driver either lacks WHQL certification, has an expired signature, or uses a signing certificate not trusted for kernel code. This event is directly relevant to BYOVD attacks, as adversaries frequently use drivers with expired or revoked WHQL certificates.",
      "category": "Code Integrity",
      "tags": [
        "code-integrity",
        "whql",
        "driver-signing",
        "byovd",
        "privilege-escalation"
      ],
      "relatedEventIds": [
        {
          "id": 3001,
          "log": "CodeIntegrity"
        },
        {
          "id": 3033,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1068",
          "techniqueName": "Exploitation for Privilege Escalation",
          "tactics": [
            {
              "tacticId": "TA0004",
              "tacticName": "Privilege Escalation"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Check the driver's signing certificate validity date — expired WHQL certs on known-vulnerable drivers is a BYOVD pattern",
          "Cross-reference FileName hash against LOLDrivers (loldrivers.io) for known vulnerable driver matches",
          "Identify the loading process — drivers loaded by non-system processes or from unusual paths are high priority"
        ],
        "commonFalsePositives": [
          "Older hardware drivers with expired WHQL certificates that are otherwise benign",
          "Hardware manufacturer drivers not submitted for WHQL certification (common with less mainstream devices)"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the driver that failed the WHQL signing check"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-02"
    },
    {
      "id": 3076,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Information",
      "title": "WDAC policy audit event",
      "summary": "Windows Defender Application Control detected a file that would be blocked by the active policy (audit mode).",
      "details": "Generated when a Windows Defender Application Control (WDAC) policy in audit mode detects a file that would be blocked if enforcement were active. EID 3076 is the WDAC-specific audit event, whereas EID 3034 is the general Code Integrity audit event. In environments with named WDAC policies, the PolicyName field helps attribute the detection to the relevant rule set. This event is commonly used for WDAC policy tuning.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "A Windows Defender Application Control (WDAC) policy must be deployed and active in audit mode for this event to be generated."
        }
      ],
      "category": "WDAC Policy",
      "tags": [
        "code-integrity",
        "wdac",
        "audit-mode",
        "application-control",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3034,
          "log": "CodeIntegrity"
        },
        {
          "id": 3077,
          "log": "CodeIntegrity"
        },
        {
          "id": 3089,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.006",
          "techniqueName": "Subvert Trust Controls: Code Signing Policy Modification",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "PolicyName identifies which WDAC rule triggered — useful for understanding what rule the attacker's file would violate",
          "Correlate with EID 3089 to get additional context on the same file load event",
          "In IR, treat audit events as successful loads — pivot on FileName to assess impact"
        ],
        "commonFalsePositives": [
          "Unsigned internal software during WDAC policy baseline development",
          "Scripting interpreters (python.exe, node.exe) executing user scripts not yet in the allow list"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file detected in audit mode"
        },
        {
          "name": "ProcessNameBuffer",
          "xpath": "EventData/Data[@Name='ProcessNameBuffer']",
          "description": "Process that loaded the file"
        },
        {
          "name": "PolicyName",
          "xpath": "EventData/Data[@Name='PolicyName']",
          "description": "Name of the WDAC policy that triggered the audit event"
        },
        {
          "name": "PolicyId",
          "xpath": "EventData/Data[@Name='PolicyId']",
          "description": "Identifier of the WDAC policy"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows 10 / Server 2016"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3077,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Warning",
      "title": "WDAC policy enforcement block",
      "summary": "Windows Defender Application Control blocked a file from executing under the active enforcement policy.",
      "details": "Generated when a Windows Defender Application Control (WDAC) policy in enforcement mode blocks a file from loading or executing. This is the enforcement-mode counterpart to EID 3076. EID 3077 indicates the file was actually blocked -- unlike audit mode, the load did not succeed. Repeated events for the same file indicate persistent load attempts against the active WDAC policy.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "A Windows Defender Application Control (WDAC) policy must be deployed and active in enforcement mode for this event to be generated."
        }
      ],
      "category": "WDAC Policy",
      "tags": [
        "code-integrity",
        "wdac",
        "enforcement",
        "application-control",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3076,
          "log": "CodeIntegrity"
        },
        {
          "id": 3089,
          "log": "CodeIntegrity"
        },
        {
          "id": 3033,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.006",
          "techniqueName": "Subvert Trust Controls: Code Signing Policy Modification",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        },
        {
          "techniqueId": "T1068",
          "techniqueName": "Exploitation for Privilege Escalation",
          "tactics": [
            {
              "tacticId": "TA0004",
              "tacticName": "Privilege Escalation"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "FileName is the primary artifact — hash and check against threat intel and LOLDrivers",
          "ProcessNameBuffer identifies what attempted to load the blocked file — unexpected loaders are high priority",
          "Multiple EID 3077 events for different files from the same process suggest a loader actively probing policy limits"
        ],
        "commonFalsePositives": [
          "Software deployed without being added to the WDAC allow policy — common during initial rollout",
          "Portable applications or scripts that are not signed and not yet catalogued"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file that was blocked"
        },
        {
          "name": "ProcessNameBuffer",
          "xpath": "EventData/Data[@Name='ProcessNameBuffer']",
          "description": "Process that attempted to load the blocked file"
        },
        {
          "name": "PolicyName",
          "xpath": "EventData/Data[@Name='PolicyName']",
          "description": "Name of the WDAC policy that blocked the file"
        },
        {
          "name": "PolicyId",
          "xpath": "EventData/Data[@Name='PolicyId']",
          "description": "Identifier of the WDAC policy"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "rare",
      "windowsVersions": {
        "minVersion": "Windows 10 / Server 2016"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3089,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Information",
      "title": "WDAC correlated event",
      "summary": "A correlated WDAC event providing supplemental context for a policy audit or enforcement event.",
      "details": "Generated alongside EID 3076 (audit) or EID 3077 (enforcement) events to provide supplemental information about the WDAC policy decision. Includes additional signing or hash details not included in the primary event. EID 3089 is typically generated in a 1:1 ratio with EID 3076/3077 and provides additional context for the same file load.",
      "category": "WDAC Policy",
      "tags": [
        "code-integrity",
        "wdac",
        "application-control",
        "correlation"
      ],
      "relatedEventIds": [
        {
          "id": 3076,
          "log": "CodeIntegrity"
        },
        {
          "id": 3077,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.006",
          "techniqueName": "Subvert Trust Controls: Code Signing Policy Modification",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Always pair EID 3089 with the corresponding EID 3076 or 3077 using the same FileName and timestamp",
          "The signing details in EID 3089 provide the certificate information needed to assess driver trust",
          "PolicyId links this event to the specific WDAC policy that generated the primary block or audit event"
        ],
        "commonFalsePositives": [
          "Generated as a side-effect of any EID 3076/3077 event — treat as supplemental data, not an independent alert"
        ]
      },
      "keyFields": [
        {
          "name": "FileName",
          "xpath": "EventData/Data[@Name='FileName']",
          "description": "Path of the file from the correlated event"
        },
        {
          "name": "PolicyName",
          "xpath": "EventData/Data[@Name='PolicyName']",
          "description": "Name of the WDAC policy"
        },
        {
          "name": "PolicyId",
          "xpath": "EventData/Data[@Name='PolicyId']",
          "description": "Identifier linking to the specific WDAC policy"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "rare",
      "windowsVersions": {
        "minVersion": "Windows 10 / Server 2016"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 3099,
      "log": "CodeIntegrity",
      "provider": "Microsoft-Windows-CodeIntegrity",
      "channel": "Microsoft-Windows-CodeIntegrity/Operational",
      "level": "Information",
      "title": "Code Integrity policy activated or deactivated",
      "summary": "A Code Integrity or WDAC policy was loaded, refreshed, or deactivated.",
      "details": "Generated when a Code Integrity or Windows Defender Application Control (WDAC) policy is activated, refreshed, or deactivated on the system. Records the policy name, ID, and whether the policy is being enabled or disabled. This event fires after both legitimate policy deployments and unauthorized policy changes.",
      "category": "WDAC Policy",
      "tags": [
        "code-integrity",
        "wdac",
        "policy-change",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3077,
          "log": "CodeIntegrity"
        },
        {
          "id": 3076,
          "log": "CodeIntegrity"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1553.006",
          "techniqueName": "Subvert Trust Controls: Code Signing Policy Modification",
          "tactics": [
            {
              "tacticId": "TA0112",
              "tacticName": "Defense Impairment"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Verify whether the policy change was authorized — correlate with change management records or admin activity",
          "A policy deactivation followed by new EID 3034 or EID 3001 events indicates enforcement was intentionally bypassed",
          "PolicyId identifies which policy was changed — correlate with the expected active policy set for this host"
        ],
        "commonFalsePositives": [
          "Authorized IT/security team deploying an updated WDAC policy baseline",
          "Group Policy refresh applying a new WDAC policy to managed endpoints"
        ]
      },
      "keyFields": [
        {
          "name": "PolicyNameBuffer",
          "xpath": "EventData/Data[@Name='PolicyNameBuffer']",
          "description": "Name of the policy that was activated, refreshed, or deactivated"
        },
        {
          "name": "PolicyId",
          "xpath": "EventData/Data[@Name='PolicyId']",
          "description": "Identifier of the policy"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows 10 / Server 2016"
      },
      "lastReviewed": "2026-05-10"
    }
  ]
}