Windows Code Integrity: Detection of Unmet Signing Level Requirements

Windows Code Integrity operational logs record instances where a process attempts to load a file (typically a DLL) that does not meet established signing requirements. This behavior may be triggered by revoked signatures, expired certificates using the Lifetime Signing EKU, or policies violated by non-compliant binaries. While often associated with legitimate but poorly signed software or antivirus drivers, these events are critical for identifying unauthorized or tampered code attempting to execute in restricted environments.

Impact

Legitimate system instability or software failure may occur if critical components are blocked from loading. From a security perspective, these events highlight potential attempts to load unauthorized DLLs or bypass Windows Defender Application Control (WDAC) policies.

Recommendation

• Enable the 'Microsoft-Windows-CodeIntegrity/Operational' event log channel on endpoints where WDAC or strict code signing policies are enforced.
• Review Event IDs 3033 (blocked) and 3034 (allowed due to audit policy) to identify anomalous file loads.
• Baseline common false positives in your environment, such as those generated by AV agents, Electron-based applications, and legacy software that may not adhere to modern signing requirements.
• Correlate these events with Event ID 3089 to determine the specific technical reason for the signature validation failure.