LoFP LoFP / antivirus and other third party products are known to trigger this rule quite a lot. initial filters and tuning is required before using this rule.

Techniques

Sample rules

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

Description

Detects attempted file load events that did not meet the signing level requirements. It often means the file’s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.

Detection logic

condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
filter_main_gac:
  FileNameBuffer|contains: \Windows\assembly\GAC\
  ProcessNameBuffer|contains: \Windows\Microsoft.NET\
  ProcessNameBuffer|endswith: \mscorsvw.exe
  RequestedPolicy: 8
filter_optional_av_generic:
  FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\
  FileNameBuffer|endswith: \igd10iumd64.dll
  RequestedPolicy: 7
filter_optional_avast:
  FileNameBuffer|endswith:
  - \Program Files\Avast Software\Avast\aswAMSI.dll
  - \Program Files (x86)\Avast Software\Avast\aswAMSI.dll
  RequestedPolicy:
  - 8
  - 12
filter_optional_bonjour:
  FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll
  ProcessNameBuffer|endswith:
  - \Windows\System32\svchost.exe
  - \Windows\System32\SIHClient.exe
  RequestedPolicy:
  - 8
  - 12
filter_optional_dtrace:
  FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll
  ProcessNameBuffer|endswith: \Windows\System32\svchost.exe
  RequestedPolicy: 12
filter_optional_electron_based_app:
  FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll
  ProcessNameBuffer|endswith:
  - \AppData\Local\Keybase\Gui\Keybase.exe
  - \Microsoft\Teams\stage\Teams.exe
  RequestedPolicy: 8
filter_optional_eset:
  FileNameBuffer|endswith: \Program Files\ESET\ESET Security\eamsi.dll
filter_optional_firefox:
  FileNameBuffer|endswith:
  - \Mozilla Firefox\mozavcodec.dll
  - \Mozilla Firefox\mozavutil.dll
  ProcessNameBuffer|endswith: \Mozilla Firefox\firefox.exe
  RequestedPolicy: 8
filter_optional_google_drive:
  FileNameBuffer|contains: \Program Files\Google\Drive File Stream\
  FileNameBuffer|endswith: \crashpad_handler.exe
  ProcessNameBuffer|endswith: \Windows\ImmersiveControlPanel\SystemSettings.exe
  RequestedPolicy: 8
filter_optional_mcafee:
  FileNameBuffer|endswith:
  - \Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll
  - \Program Files\McAfee\MfeAV\AMSIExt.dll
filter_optional_mdns_responder:
  FileNameBuffer|endswith: '\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll '
filter_optional_msoffice:
  FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft
    Shared\OFFICE
  FileNameBuffer|endswith: \MSOXMLMF.DLL
  RequestedPolicy: 7
filter_optional_slack:
  FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll
  ProcessNameBuffer|contains: \AppData\Local\slack\app-
  ProcessNameBuffer|endswith: \slack.exe
  RequestedPolicy: 8
filter_optional_trend_micro:
  FileNameBuffer|endswith: \Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll
  RequestedPolicy: 8
selection:
  EventID:
  - 3033
  - 3034