Detectioninformationalstable

Failed Code Integrity Checks

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Thomas PatzkeCreated Tue Dec 03Updated Sun Jan 19470ec5fa-7b4e-4071-b200-4c753100f49bwindows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID:
            - 5038
            - 6281
    filter_optional_crowdstrike:
        param1|contains:
            - '\CSFalconServiceUninstallTool_'
            - '\Program Files\CrowdStrike\'
            - '\System32\drivers\CrowdStrike\'
            - '\Windows\System32\ScriptControl64_'
    filter_optional_sophos:
        param1|contains: '\Program Files\Sophos\'
    condition: selection and not 1 of filter_optional_*