detection.wiki

Microsoft-Windows-Security-Mitigations

EventTitleChannelSampleRule
1Process 'ProcessPath' (PID CallingProcessId) would have been blocked from …KernelModeYN
2Process 'ProcessPath' (PID CallingProcessId) was blocked from generating dynamic …KernelModeYN
3Process 'ProcessPath' (PID CallingProcessId) would have been blocked from …KernelModeYN
4Process 'ProcessPath' (PID CallingProcessId) was blocked from creating a child …KernelModeYN
5Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the …KernelModeYN
6Process 'ProcessPath' (PID ProcessId) was blocked from loading the low-integrity …KernelModeYN
7Process 'ProcessPath' (PID CallingProcessId) would have been blocking from …KernelModeYN
8Process 'ProcessPath' (PID CallingProcessId) was blocked from loading a binary …KernelModeNN
9Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making …KernelModeYN
10Process 'ProcessPath' (PID CallingProcessId) was blocked from making system …KernelModeYN
11Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the …KernelModeNY
12Process 'ProcessPath' (PID ProcessId) was blocked from loading the …KernelModeYY
13Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the …UserModeNN
14Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export …UserModeNN
15Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the …UserModeNN
16Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export …UserModeNN
17Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the …UserModeNN
18Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Import …UserModeNN
19Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the …UserModeNN
20Process 'ProcessPath' (PID ProcessId) was blocked from calling the API …UserModeNN
21Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the …UserModeNN
22Process 'ProcessPath' (PID ProcessId) was blocked from calling the API …UserModeNN
23Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the …UserModeNN
24Process 'ProcessPath' (PID ProcessId) was blocked from calling the API …UserModeNN
25Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return …KernelModeNN
26Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return …KernelModeNN
27Process 'ProcessPath' (PID ProcessId) would have been blocked from setting …KernelModeNN
28Process 'ProcessPath' (PID ProcessId) was blocked from setting context due to …KernelModeNN
29Process 'ProcessPath' (PID ProcessId) would have been blocked from loading an …KernelModeNN
30Process 'ProcessPath' (PID ProcessId) was blocked from loading an image binary …KernelModeNN
31Process 'Arguments' (PID Impersonating) would have been blocked from following …KernelModeNN
32Process 'Arguments' (PID Impersonating) was blocked from following an untrusted …KernelModeNN
33The system has encountered a kernel-mode shadow stack return address mismatch.KernelModeNN
34The system has encountered a kernel-mode shadow stack return address mismatch.KernelModeNN
35Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making …KernelModeNN
36Process 'ProcessPath' (PID CallingProcessId) was blocked from making the …KernelModeNN

Event ID 1: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from generating dynamic code.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODE

Message #

Process '%2' (PID %5) would have been blocked from generating dynamic code.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "{FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 0,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T16:33:27.7050527+00:00",
    "event_record_id": 67,
    "correlation": {},
    "execution": {
      "process_id": 3448,
      "thread_id": 5600
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessPathLength": "52",
    "ProcessPath": "\\Device\\HarddiskVolume1\\Windows\\System32\\spoolsv.exe",
    "ProcessCommandLineLength": "31",
    "ProcessCommandLine": "C:\\Windows\\System32\\spoolsv.exe",
    "CallingProcessId": "3448",
    "CallingProcessCreateTime": "2026-05-29T16:33:03.3624351Z",
    "CallingProcessStartKey": "4222124650659908",
    "CallingProcessSignatureLevel": "0",
    "CallingProcessSectionSignatureLevel": "0",
    "CallingProcessProtection": "0",
    "CallingThreadId": "5600",
    "CallingThreadCreateTime": "2026-05-29T16:33:27.7046692Z"
  },
  "message": "Process '\\Device\\HarddiskVolume1\\Windows\\System32\\spoolsv.exe' (PID 3448) would have been blocked from generating dynamic code."
}

References #

Event ID 2: Process 'ProcessPath' (PID CallingProcessId) was blocked from generating dynamic code.

#
Channel
KernelMode
Level
Warning
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_DYNAMIC_CODE

Message #

Process '%2' (PID %5) was blocked from generating dynamic code.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:01:34.932541+00:00",
    "event_record_id": 88,
    "correlation": {},
    "execution": {
      "process_id": 11664,
      "thread_id": 10404
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "ProcessPathLength": 59,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Program Files\\TeamViewer\\tv_x64.exe",
    "ProcessCommandLineLength": 192,
    "ProcessCommandLine": "\"C:\\Program Files\\TeamViewer\\tv_x64.exe\" --action installpnpdriver --inf \"C:\\Program Files\\TeamViewer\\x64\\TVVirtualMonitorDriver.inf\" --log \"C:\\Program Files\\TeamViewer\\TeamViewer15_Hooks.log\"",
    "CallingProcessId": 11664,
    "CallingProcessCreateTime": "2023-11-06T01:01:34.836839Z",
    "CallingProcessStartKey": 3659174697240700,
    "CallingProcessSignatureLevel": 2,
    "CallingProcessSectionSignatureLevel": 2,
    "CallingProcessProtection": 0,
    "CallingThreadId": 10404,
    "CallingThreadCreateTime": "2023-11-06T01:01:34.836843Z"
  },
  "message": ""
}

References #

Event ID 3: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATION

Message #

Process '%2' (PID %5) would have been blocked from creating a child process '%14' with command line '%16'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.
ChildImagePathNameLength UInt16
ChildImagePathName UnicodeString
ChildCommandLineLength UInt16
ChildCommandLine UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 0,
    "task": 2,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-26T04:19:22.802481+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 2524,
      "thread_id": 452
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessPathLength": 52,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Windows\\System32\\spoolsv.exe",
    "ProcessCommandLineLength": 31,
    "ProcessCommandLine": "C:\\Windows\\System32\\spoolsv.exe",
    "CallingProcessId": 2524,
    "CallingProcessCreateTime": "2023-10-26T04:17:19.791140Z",
    "CallingProcessStartKey": 281474976710715,
    "CallingProcessSignatureLevel": 2,
    "CallingProcessSectionSignatureLevel": 2,
    "CallingProcessProtection": 0,
    "CallingThreadId": 452,
    "CallingThreadCreateTime": "2023-10-26T04:19:20.206505Z",
    "ChildImagePathNameLength": 32,
    "ChildImagePathName": "C:\\Windows\\SysWOW64\\regsvr32.exe",
    "ChildCommandLineLength": 73,
    "ChildCommandLine": "C:\\Windows\\SysWOW64\\regsvr32.exe /s \"C:\\Windows\\SysWOW64\\PrintConfig.dll\""
  },
  "message": ""
}

References #

Event ID 4: Process 'ProcessPath' (PID CallingProcessId) was blocked from creating a child process 'ChildImagePathName' with command line 'ChildCommandLine'.

#
Channel
KernelMode
Level
Warning
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_CHILD_PROCESS_CREATION

Message #

Process '%2' (PID %5) was blocked from creating a child process '%14' with command line '%16'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.
ChildImagePathNameLength UInt16
ChildImagePathName UnicodeString
ChildCommandLineLength UInt16
ChildCommandLine UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 3,
    "task": 2,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:47.998503+00:00",
    "event_record_id": 3000,
    "correlation": {},
    "execution": {
      "process_id": 6084,
      "thread_id": 6236
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProcessPathLength": 94,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Program Files\\Windows Defender Advanced Threat Protection\\SenseNdr.exe",
    "ProcessCommandLineLength": 512,
    "ProcessCommandLine": "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseNdr.exe\"  \"eyJDbGllbnRWZXIiOiIxMC44MjEwLjIyNjIxLjQ1NyIsIkNvbXBvbmVudHMiOlt7IkFkYXB0ZXJJZCI6Ins4QTE3NjBCNi1EQzk5LTRCOTAtOUM0QS0wMjk2OThFNUFFMjd9IiwiQ2F0ZWdvcnkiOjIsIkRlZmF1bHRHYXRld2F5cyI6W3siQWRkcmVzcyI6IjEwLjIuMTAuMjU0IiwiTUFDIjoiYmM6MjQ6MTE6MjI6NWI6NTcifV0sIkRvbWFpblR5cGUiOjAsIklwQWRkcmVzc2VzIjpbeyJBZGRyZXNzIjoiMTAuMi4xMC4yMSIsIk1BU0siOjI0fV0sIk5ldE5hbWUiOiJOZXR3b3JrIDIiLCJQaHlzaWNhbEFkZHIiOiJiYzI0MTE5YTRkYzIiLCJQa3RNb25JZCI6MSwiUmVnaXN0cn",
    "CallingProcessId": 6084,
    "CallingProcessCreateTime": "2026-03-11T06:27:47.450908Z",
    "CallingProcessStartKey": 4222124650660002,
    "CallingProcessSignatureLevel": 8,
    "CallingProcessSectionSignatureLevel": 8,
    "CallingProcessProtection": 0,
    "CallingThreadId": 6236,
    "CallingThreadCreateTime": "2026-03-11T06:27:47.450927Z",
    "ChildImagePathNameLength": 35,
    "ChildImagePathName": "\\??\\C:\\Windows\\system32\\conhost.exe",
    "ChildCommandLineLength": 55,
    "ChildCommandLine": "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
  },
  "message": ""
}

Event ID 5: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the low-integrity binary 'ImageName'.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAP

Message #

Process '%2' (PID %5) would have been blocked from loading the low-integrity binary '%14'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetThreadId UInt32Thread ID in the target process.
TargetThreadCreateTime FILETIMECreation timestamp of the target thread.
ImageNameLength UInt16
ImageName UnicodeString

Example Event #

{
  "event_data": {
    "ImageName": "\\localhost\\C$\\Windows\\System32\\version.dll",
    "ImageNameLength": 42,
    "ProcessCommandLine": "\"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\mitig_trigger_script.ps1\" ",
    "ProcessCommandLineLength": 226,
    "ProcessCreateTime": "2026-07-21T00:43:05.451810Z",
    "ProcessId": 4136,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe",
    "ProcessPathLength": 110,
    "ProcessProtection": 0,
    "ProcessSectionSignatureLevel": 0,
    "ProcessSignatureLevel": 0,
    "ProcessStartKey": 9288674231456507,
    "TargetThreadCreateTime": "2026-07-21T00:43:05.970213Z",
    "TargetThreadId": 10484
  },
  "message": "",
  "system": {
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WORKSTATION.example.local",
    "correlation": {},
    "event_id": 5,
    "event_record_id": 19068,
    "event_source_name": "",
    "execution": {
      "process_id": 4136,
      "thread_id": 10484
    },
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "keywords": 9223372036854775808,
    "level": 0,
    "opcode": 0,
    "provider": "Microsoft-Windows-Security-Mitigations",
    "security": {
      "user_id": "S-1-5-21-000000000-000000000-000000000-1105"
    },
    "task": 4,
    "time_created": "2026-07-21T00:43:06.741754+00:00",
    "version": 0
  }
}

Event ID 6: Process 'ProcessPath' (PID ProcessId) was blocked from loading the low-integrity binary 'ImageName'.

#
Channel
KernelMode
Level
Warning
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_LOWIL_IMAGE_MAP

Message #

Process '%2' (PID %5) was blocked from loading the low-integrity binary '%14'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetThreadId UInt32Thread ID in the target process.
TargetThreadCreateTime FILETIMECreation timestamp of the target thread.
ImageNameLength UInt16
ImageName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-19T16:58:40.759182+00:00",
    "event_record_id": 19036,
    "correlation": {},
    "execution": {
      "process_id": 1880,
      "thread_id": 3760
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "ProcessPathLength": 42,
    "ProcessPath": "\\Device\\HarddiskVolume4\\dwcap\\dwloader.exe",
    "ProcessCommandLineLength": 82,
    "ProcessCommandLine": "\"C:\\dwcap\\dwloader.exe\" -NoProfile -ExecutionPolicy Bypass -File C:\\dwcap\\load.ps1",
    "ProcessId": 1880,
    "ProcessCreateTime": "2026-07-19T16:58:40.134489Z",
    "ProcessStartKey": 8725724278043814,
    "ProcessSignatureLevel": 0,
    "ProcessSectionSignatureLevel": 0,
    "ProcessProtection": 0,
    "TargetThreadId": 3760,
    "TargetThreadCreateTime": "2026-07-19T16:58:40.407123Z",
    "ImageNameLength": 16,
    "ImageName": "\\dwcap\\lowil.dll"
  },
  "message": ""
}

Event ID 7: Process 'ProcessPath' (PID CallingProcessId) would have been blocking from loading a binary from a remote share.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAP

Message #

Process '%2' (PID %5) would have been blocking from loading a binary from a remote share.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Example Event #

{
  "event_data": {
    "CallingProcessCreateTime": "2026-07-21T00:43:05.451810Z",
    "CallingProcessId": 4136,
    "CallingProcessProtection": 0,
    "CallingProcessSectionSignatureLevel": 0,
    "CallingProcessSignatureLevel": 0,
    "CallingProcessStartKey": 9288674231456507,
    "CallingThreadCreateTime": "2026-07-21T00:43:05.970213Z",
    "CallingThreadId": 10484,
    "ProcessCommandLine": "\"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\mitig_trigger_script.ps1\" ",
    "ProcessCommandLineLength": 226,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe",
    "ProcessPathLength": 110
  },
  "message": "",
  "system": {
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WORKSTATION.example.local",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 19067,
    "event_source_name": "",
    "execution": {
      "process_id": 4136,
      "thread_id": 10484
    },
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "keywords": 9223372036854775808,
    "level": 0,
    "opcode": 0,
    "provider": "Microsoft-Windows-Security-Mitigations",
    "security": {
      "user_id": "S-1-5-21-000000000-000000000-000000000-1105"
    },
    "task": 3,
    "time_created": "2026-07-21T00:43:06.741452+00:00",
    "version": 0
  }
}

Event ID 8: Process 'ProcessPath' (PID CallingProcessId) was blocked from loading a binary from a remote share.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_REMOTE_IMAGE_MAP

Message #

Process '%2' (PID %5) was blocked from loading a binary from a remote share.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Event ID 9: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making system calls to Win32k.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLS

Description

Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making system calls to Win32k.sys.

Message #

Process '%2' (PID %5) would have been blocked from making system calls to Win32k.sys.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Example Event #

{
  "event_data": {
    "CallingProcessCreateTime": "2026-07-21T00:43:05.451810Z",
    "CallingProcessId": 4136,
    "CallingProcessProtection": 0,
    "CallingProcessSectionSignatureLevel": 0,
    "CallingProcessSignatureLevel": 0,
    "CallingProcessStartKey": 9288674231456507,
    "CallingThreadCreateTime": "2026-07-21T00:43:05.451826Z",
    "CallingThreadId": 4572,
    "ProcessCommandLine": "\"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\mitig_trigger_script.ps1\" ",
    "ProcessCommandLineLength": 226,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Users\\user\\AppData\\Local\\Temp\\mde_capture\\mitig_scratch\\dwtest_mitig_target.exe",
    "ProcessPathLength": 110
  },
  "message": "",
  "system": {
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WORKSTATION.example.local",
    "correlation": {},
    "event_id": 9,
    "event_record_id": 19066,
    "event_source_name": "",
    "execution": {
      "process_id": 4136,
      "thread_id": 4572
    },
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "keywords": 9223372036854775808,
    "level": 0,
    "opcode": 0,
    "provider": "Microsoft-Windows-Security-Mitigations",
    "security": {
      "user_id": "S-1-5-21-000000000-000000000-000000000-1105"
    },
    "task": 5,
    "time_created": "2026-07-21T00:43:05.549764+00:00",
    "version": 0
  }
}

Event ID 10: Process 'ProcessPath' (PID CallingProcessId) was blocked from making system calls to Win32k.

#
Channel
KernelMode
Level
Warning
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_WIN32K_SYSTEM_CALLS

Description

Process 'ProcessPath' (PID CallingProcessId) was blocked from making system calls to Win32k.sys.

Message #

Process '%2' (PID %5) was blocked from making system calls to Win32k.sys.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 3,
    "task": 5,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:55:30.233087+00:00",
    "event_record_id": 194,
    "correlation": {},
    "execution": {
      "process_id": 17736,
      "thread_id": 9464
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "ProcessPathLength": 65,
    "ProcessPath": "\\Device\\HarddiskVolume4\\Program Files\\Mozilla Firefox\\firefox.exe",
    "ProcessCommandLineLength": 412,
    "ProcessCommandLine": "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -contentproc --channel=7928 -childID 13 -isForBrowser -prefsHandle 7924 -prefMapHandle 7272 -prefsLen 37923 -prefMapSize 235045 -jsInitHandle 1588 -jsInitLen 235336 -parentBuildID 20231019122658 -win32kLockedDown -appDir \"C:\\Program Files\\Mozilla Firefox\\browser\" - {9095c7bc-c09b-4e88-a55a-1b4a7ff727a7} 4148 \"\\\\.\\pipe\\gecko-crash-server-pipe.4148\" 22025387bd0 tab",
    "CallingProcessId": 17736,
    "CallingProcessCreateTime": "2023-11-06T01:55:29.635202Z",
    "CallingProcessStartKey": 3659174697241340,
    "CallingProcessSignatureLevel": 2,
    "CallingProcessSectionSignatureLevel": 2,
    "CallingProcessProtection": 0,
    "CallingThreadId": 9464,
    "CallingThreadCreateTime": "2023-11-06T01:55:29.635208Z"
  },
  "message": ""
}

References #

Event ID 11: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading the non-Microsoft-signed binary 'ImageName'.

#
Channel
KernelMode
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES

Message #

Process '%2' (PID %5) would have been blocked from loading the non-Microsoft-signed binary '%16'.

Fields #

NameDescriptionRules
ProcessPathLength UInt16
ProcessPath UnicodeString2 detection rules
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetThreadId UInt32Thread ID in the target process.
TargetThreadCreateTime FILETIMECreation timestamp of the target thread.
RequiredSignatureLevel UInt8
SignatureLevel UInt8Code integrity signing level of the process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
ImageNameLength UInt16
ImageName UnicodeString6 detection rules

Detection Patterns #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
Imagecontains\appdata\local\temp\1 rulesigma
Imagecontains\desktop\1 rulesigma
Imagecontains\downloads\1 rulesigma
Imagecontains\perflogs\1 rulesigma
Imagecontains\users\public\1 rulesigma
Imagecontainsc:\windows\temp\1 rulesigma

Event ID 12: Process 'ProcessPath' (PID ProcessId) was blocked from loading the non-Microsoft-signed binary 'ImageName'.

#
Channel
KernelMode
Level
Warning
Collection Priority
Recommended (JSCU-NL)
Task
KERNEL_MITIGATION_TASK_PROHIBIT_NON_MICROSOFT_BINARIES

Message #

Process '%2' (PID %5) was blocked from loading the non-Microsoft-signed binary '%16'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetThreadId UInt32Thread ID in the target process.
TargetThreadCreateTime FILETIMECreation timestamp of the target thread.
RequiredSignatureLevel UInt8
SignatureLevel UInt8Code integrity signing level of the process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
ImageNameLength UInt16
ImageName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Mitigations",
    "guid": "{FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 3,
    "task": 6,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T05:39:33.8737054+00:00",
    "event_record_id": 71,
    "correlation": {},
    "execution": {
      "process_id": 4084,
      "thread_id": 7332
    },
    "channel": "Microsoft-Windows-Security-Mitigations/KernelMode",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessPathLength": "99",
    "ProcessPath": "\\Device\\HarddiskVolume1\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26040.7-0\\MpCmdRun.exe",
    "ProcessCommandLineLength": "132",
    "ProcessCommandLine": "\"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26040.7-0\\MpCmdRun.exe\" Scan -ScheduleJob -ScanTrigger 55 -IdleScheduledJob",
    "ProcessId": "4084",
    "ProcessCreateTime": "2026-06-13T05:39:30.8781793Z",
    "ProcessStartKey": "4222124650660460",
    "ProcessSignatureLevel": "8",
    "ProcessSectionSignatureLevel": "8",
    "ProcessProtection": "0",
    "TargetThreadId": "7332",
    "TargetThreadCreateTime": "2026-06-13T05:39:33.0602578Z",
    "RequiredSignatureLevel": "8",
    "SignatureLevel": "0",
    "ImageNameLength": "33",
    "ImageName": "\\Windows\\System32\\rpcFireWall.dll"
  },
  "message": "Process '\\Device\\HarddiskVolume1\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26040.7-0\\MpCmdRun.exe' (PID 4084) was blocked from loading the non-Microsoft-signed binary '\\Windows\\System32\\rpcFireWall.dll'."
}

Detection Patterns #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
Imagecontains\appdata\local\temp\1 rulesigma
Imagecontains\desktop\1 rulesigma
Imagecontains\downloads\1 rulesigma
Imagecontains\perflogs\1 rulesigma
Imagecontains\users\public\1 rulesigma
Imagecontainsc:\windows\temp\1 rulesigma

References #

Event ID 13: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER

Message #

Process '%2' (PID %3) would have been blocked from accessing the Export Address Table for module '%8'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 14: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER

Message #

Process '%2' (PID %3) was blocked from accessing the Export Address Table for module '%8'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 15: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Export Address Table for module 'MemModuleFullPath'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS

Message #

Process '%2' (PID %3) would have been blocked from accessing the Export Address Table for module '%8'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 16: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Export Address Table for module 'MemModuleFullPath'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_EXPORT_ADDRESS_FILTER_PLUS

Message #

Process '%2' (PID %3) was blocked from accessing the Export Address Table for module '%8'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 17: Process 'ProcessPath' (PID ProcessId) would have been blocked from accessing the Import Address Table for API 'APIName'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTER

Message #

Process '%2' (PID %3) would have been blocked from accessing the Import Address Table for API '%10'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 18: Process 'ProcessPath' (PID ProcessId) was blocked from accessing the Import Address Table for API 'APIName'.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_IMPORT_ADDRESS_FILTER

Message #

Process '%2' (PID %3) was blocked from accessing the Import Address Table for API '%10'.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
ModuleFullPath UnicodeString
ModuleBase Pointer
ModuleAddress Pointer
MemAddress Pointer
MemModuleFullPath UnicodeString
MemModuleBase Pointer
APIName UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 19: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_STACKPIVOT

Message #

Process '%2' (PID %3) would have been blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 20: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_STACKPIVOT

Message #

Process '%2' (PID %3) was blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 21: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_CALLERCHECK

Message #

Process '%2' (PID %3) would have been blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 22: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_CALLERCHECK

Message #

Process '%2' (PID %3) was blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

Event ID 23: Process 'ProcessPath' (PID ProcessId) would have been blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_SIMEXEC

Message #

Process '%2' (PID %3) would have been blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 24: Process 'ProcessPath' (PID ProcessId) was blocked from calling the API 'HookedAPI' due to return-oriented programming (ROP) exploit indications.

#
Channel
UserMode
Collection Priority
Recommended (JSCU-NL)
Task
USER_MITIGATION_TASK_ROP_SIMEXEC

Message #

Process '%2' (PID %3) was blocked from calling the API '%4' due to return-oriented programming (ROP) exploit indications.

Fields #

NameDescription
Subcode UInt32
ProcessPath UnicodeString
ProcessId UInt32
HookedAPI UnicodeString
ReturnAddress Pointer
CalledAddress Pointer
TargetAddress Pointer
StackAddress Pointer
FrameAddress Pointer
ReturnAddressModuleFullPath UnicodeString
ProcessStartTime FILETIME
ThreadId UInt32

References #

Event ID 25: Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return address mismatch.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH

Description

Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution.

Message #

Process '%2' (PID %5) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution.

Return instruction executed from module '%12'.
Attempting to return to module '%14'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
ControlPcImageNameLength UInt16
ControlPcImageName UnicodeString
RspContentsImageNameLength UInt16
RspContentsImageName UnicodeString
StrictMode Boolean
UserCetAppcompatOptions UInt32
NonenforcementReason UInt32
ControlPcAddress Pointer
ControlPcOffset Pointer
ControlPcCetCompat Boolean
RspContentsAddress Pointer
RspContentsOffset Pointer
RspContentsCetCompat Boolean

References #

Event ID 26: Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return address mismatch.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_USER_MODE_RETURN_MISMATCH

Description

Process 'ProcessPath' (PID ProcessId) has encountered a shadow stack return address mismatch. The process will be terminated.

Message #

Process '%2' (PID %5) has encountered a shadow stack return address mismatch. The process will be terminated.

Return instruction executed from module '%12'.
Attempting to return to module '%14'.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
ControlPcImageNameLength UInt16
ControlPcImageName UnicodeString
RspContentsImageNameLength UInt16
RspContentsImageName UnicodeString
StrictMode Boolean
UserCetAppcompatOptions UInt32
NonenforcementReason UInt32
ControlPcAddress Pointer
ControlPcOffset Pointer
ControlPcCetCompat Boolean
RspContentsAddress Pointer
RspContentsOffset Pointer
RspContentsCetCompat Boolean

Event ID 27: Process 'ProcessPath' (PID ProcessId) would have been blocked from setting context due to instruction pointer validation failure when user-mode shadow stack is ena...

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE

Description

Process 'ProcessPath' (PID ProcessId) would have been blocked from setting context due to instruction pointer validation failure when user-mode shadow stack is enabled.

Message #

Process '%2' (PID %5) would have been blocked from setting context due to instruction pointer validation failure when user-mode shadow stack is enabled.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetIpImageNameLength UInt16
TargetIpImageName UnicodeString
StrictMode Boolean
ContinueType UInt32

Event ID 28: Process 'ProcessPath' (PID ProcessId) was blocked from setting context due to instruction pointer validation failure when user-mode shadow stack is enabled.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_USER_CET_SET_CONTEXT_IP_VALIDATION_FAILURE

Message #

Process '%2' (PID %5) was blocked from setting context due to instruction pointer validation failure when user-mode shadow stack is enabled.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
TargetIpImageNameLength UInt16
TargetIpImageName UnicodeString
StrictMode Boolean
ContinueType UInt32

Event ID 29: Process 'ProcessPath' (PID ProcessId) would have been blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing...

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIES

Description

Process 'ProcessPath' (PID ProcessId) would have been blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing exception handling continuation data.

Message #

Process '%2' (PID %5) would have been blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing exception handling continuation data.
Process requires binaries to also contain exception handling continuation data: %15

Binary path: %12
Binary compatible with shadow stacks: %13
Binary contains exception handling continuation data: %14

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
MappedImageNameLength UInt16
MappedImageName UnicodeString
ImageCetShadowStacksReady Boolean
ImageEHContinuationTablePresent Boolean
NonEhcontMode Boolean

Event ID 30: Process 'ProcessPath' (PID ProcessId) was blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing exception h...

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_BLOCK_NON_CET_BINARIES

Description

Process 'ProcessPath' (PID ProcessId) was blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing exception handling continuation data.

Message #

Process '%2' (PID %5) was blocked from loading an image binary due to the binary not being compatible with shadow stacks and/or missing exception handling continuation data.
Process requires binaries to also contain exception handling continuation data: %15

Binary path: %12
Binary compatible with shadow stacks: %13
Binary contains exception handling continuation data: %14

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
MappedImageNameLength UInt16
MappedImageName UnicodeString
ImageCetShadowStacksReady Boolean
ImageEHContinuationTablePresent Boolean
NonEhcontMode Boolean

Event ID 31: Process 'Arguments' (PID Impersonating) would have been blocked from following an untrusted redirection.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICY

Message #

Process '%2' (PID %5) would have been blocked from following an untrusted redirection: 

Binary path: %2
Arguments: %4
Redirection Type: %11
Operation Path: %13
Impersonating: %14

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
RedirectionType UInt32
OperationPathLength UInt16
OperationPath UnicodeString
Impersonating Boolean
Module1 UnicodeString
Module1Offset UInt64
Module2 UnicodeString
Module2Offset UInt64
Module3 UnicodeString
Module3Offset UInt64
Module4 UnicodeString
Module4Offset UInt64
Module5 UnicodeString
Module5Offset UInt64
Module6 UnicodeString
Module6Offset UInt64
Module7 UnicodeString
Module7Offset UInt64
Module8 UnicodeString
Module8Offset UInt64
Module9 UnicodeString
Module9Offset UInt64
Module10 UnicodeString
Module10Offset UInt64
Module11 UnicodeString
Module11Offset UInt64
Module12 UnicodeString
Module12Offset UInt64
Module13 UnicodeString
Module13Offset UInt64
Module14 UnicodeString
Module14Offset UInt64
Module15 UnicodeString
Module15Offset UInt64
Module16 UnicodeString
Module16Offset UInt64

Event ID 32: Process 'Arguments' (PID Impersonating) was blocked from following an untrusted redirection.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_REDIRECTION_TRUST_POLICY

Message #

Process '%2' (PID %5) was blocked from following an untrusted redirection: 

Binary path: %2
Arguments: %4
Redirection Type: %11
Operation Path: %13
Impersonating: %14

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
ProcessId UInt32
ProcessCreateTime FILETIME
ProcessStartKey UInt64
ProcessSignatureLevel UInt8
ProcessSectionSignatureLevel UInt8
ProcessProtection UInt8
RedirectionType UInt32
OperationPathLength UInt16
OperationPath UnicodeString
Impersonating Boolean
Module1 UnicodeString
Module1Offset UInt64
Module2 UnicodeString
Module2Offset UInt64
Module3 UnicodeString
Module3Offset UInt64
Module4 UnicodeString
Module4Offset UInt64
Module5 UnicodeString
Module5Offset UInt64
Module6 UnicodeString
Module6Offset UInt64
Module7 UnicodeString
Module7Offset UInt64
Module8 UnicodeString
Module8Offset UInt64
Module9 UnicodeString
Module9Offset UInt64
Module10 UnicodeString
Module10Offset UInt64
Module11 UnicodeString
Module11Offset UInt64
Module12 UnicodeString
Module12Offset UInt64
Module13 UnicodeString
Module13Offset UInt64
Module14 UnicodeString
Module14Offset UInt64
Module15 UnicodeString
Module15Offset UInt64
Module16 UnicodeString
Module16Offset UInt64

Event ID 33: The system has encountered a kernel-mode shadow stack return address mismatch.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_KERNEL_MODE_RETURN_MISMATCH

Description

The system has encountered a kernel-mode shadow stack return address mismatch. The system will be allowed to continue execution because: NonenforcementReason.

Message #

The system has encountered a kernel-mode shadow stack return address mismatch. The system will be allowed to continue execution because: %5.

Return instruction executed from module '%2'.
(Instruction address: %6, module offset: %7)

Attempting to return to module '%4'.
(Instruction address: %9, module offset: %10)

Fields #

NameDescription
ControlPcImageNameLength UInt16
ControlPcImageName UnicodeString
RspContentsImageNameLength UInt16
RspContentsImageName UnicodeString
NonenforcementReason UInt32
ControlPcAddress Pointer
ControlPcOffset Pointer
ControlPcCetCompat Boolean
RspContentsAddress Pointer
RspContentsOffset Pointer
RspContentsCetCompat Boolean
ShadowStackOverflowReset Boolean
ErrorCode UInt32

Event ID 34: The system has encountered a kernel-mode shadow stack return address mismatch.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_CONTROL_PROTECTION_KERNEL_MODE_RETURN_MISMATCH

Description

The system has encountered a kernel-mode shadow stack return address mismatch. The system will be terminated.

Message #

The system has encountered a kernel-mode shadow stack return address mismatch. The system will be terminated.

Return instruction executed from module '%2'.
(Instruction address: %6, module offset: %7)

Attempting to return to module '%4'.
(Instruction address: %9, module offset: %10)

Fields #

NameDescription
ControlPcImageNameLength UInt16
ControlPcImageName UnicodeString
RspContentsImageNameLength UInt16
RspContentsImageName UnicodeString
NonenforcementReason UInt32
ControlPcAddress Pointer
ControlPcOffset Pointer
ControlPcCetCompat Boolean
RspContentsAddress Pointer
RspContentsOffset Pointer
RspContentsCetCompat Boolean
ShadowStackOverflowReset Boolean
ErrorCode UInt32

Event ID 35: Process 'ProcessPath' (PID CallingProcessId) would have been blocked from making the NtFsControlFile system call.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_PROHIBIT_FSCTL_SYSTEM_CALLS

Message #

Process '%2' (PID %5) would have been blocked from making the NtFsControlFile system call.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Event ID 36: Process 'ProcessPath' (PID CallingProcessId) was blocked from making the NtFsControlFile system call.

#
Channel
KernelMode
Task
KERNEL_MITIGATION_TASK_PROHIBIT_FSCTL_SYSTEM_CALLS

Message #

Process '%2' (PID %5) was blocked from making the NtFsControlFile system call.

Fields #

NameDescription
ProcessPathLength UInt16
ProcessPath UnicodeString
ProcessCommandLineLength UInt16
ProcessCommandLine UnicodeString
CallingProcessId UInt32Process ID of the process initiating the operation.
CallingProcessCreateTime FILETIMECreation timestamp of the calling process (FILETIME). Combined with CallingProcessId, uniquely identifies the process instance.
CallingProcessStartKey UInt64Kernel-assigned unique key for the calling process. Survives PID reuse.
CallingProcessSignatureLevel UInt8Code integrity signing level of the calling process executable.
Known values
0x00
Unchecked
0x04
Authenticode
0x08
Microsoft
0x0C
Windows
0x0E
WindowsTCB
CallingProcessSectionSignatureLevel UInt8Minimum signing level required for DLLs loaded into the calling process.
CallingProcessProtection UInt8PS_PROTECTION byte of the calling process.
Bitmask flags
type (bits 0-2)=0
None
type (bits 0-2)=1
PPL
type (bits 0-2)=2
PP
signer (bits 4-7)=0
None
signer (bits 4-7)=3
Antimalware
signer (bits 4-7)=4
Lsa
signer (bits 4-7)=5
Windows
signer (bits 4-7)=6
WinTcb
CallingThreadId UInt32Thread ID within the calling process that initiated the operation.
CallingThreadCreateTime FILETIMECreation timestamp of the calling thread.

Provenance

ETW provider GUID fae10392-f0af-4ac0-b8ff-9f4d920c3cdf

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB