win:codeintegrity
Code Integrity / WDAC log
Channel: Microsoft-Windows-CodeIntegrity/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Cost class
- Included
- Techniques
- 8
- Rules listed
- 10
- Events
- 18
Licensing
- License or service
- Windows OS
- What is free
- CodeIntegrity/Operational 3076-3077; AppLocker MSI and Script 8028-8040
- What costs
- Nothing
- Notes
- Edition applicability (Pro vs Enterprise) not stated on page
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: blocked code |
Techniques
Rules
Sigma 10
- CodeIntegrity - Blocked Driver Load With Revoked Certificate by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Blocked Image Load With Revoked Certificate by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Blocked Image/Driver Load For Policy Violation by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Revoked Image Loaded by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Revoked Kernel Driver Loaded by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Unmet Signing Level Requirements By File Under Validation by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Unsigned Image Loaded by Nasreddine Bencherchali (Nextron Systems)
- CodeIntegrity - Unsigned Kernel Module Loaded by Nasreddine Bencherchali (Nextron Systems)