SOC Event Lookup
Event ID 5038CodeIntegrityP2

Windows Event ID 5038: Code integrity determined image hash is not valid

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 5038 records Code Integrity rejecting a file because its image hash is not valid.

Technical Metadata

Technical metadata for Event ID 5038
Event ID5038
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Failure
MITRE ATT&CKTA0005 Defense Evasion / T1553.002 Subvert Trust Controls: Code Signing
Key fields to watchFile Name, Computer, Code Integrity context

Trigger Scenarios

This event is generated by Code Integrity when a file signature is not valid, including unauthorized modification or disk/device error conditions.

Key Fields

File Name

The path of the file whose image hash was not valid. Microsoft documents the schema as File Name: %filepath\filename%.

Computer

Identifies the host where an unsigned, modified, or corrupt driver or system file attempted to load.

Code Integrity context

Microsoft notes Code Integrity validates driver or system file integrity each time loaded into memory, and x64 kernel-mode drivers must be digitally signed.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 5038
SecurityEvent
| where EventID == 5038
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 5038
index=wineventlog source="WinEventLog:Security" EventCode=5038
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 5038
dataset = microsoft_windows_raw
| filter edr_event_id = 5038
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5038
title: Windows Security Event ID 5038
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5038
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1553.002Subvert Trust Controls: Code Signing

Detection Notes

T1553.002 Code Signing subversion is supported when FileName is under C:\Windows\System32\drivers\, C:\Windows\System32\, or a security-product directory and file telemetry shows unauthorized modification before threshold=1 Event 5038. Correlate the file hash and signer with Sysmon Event 6 or EDR data, 5035 driver failure, and vendor update timing; an invalid hash alone can be corruption.

Common False Positives

  • Microsoft notes disk device error or file corruption can produce this event.
  • Broken third-party driver updates can create repeated 5038 events until the vendor package is repaired.

Related Events

Sample Log

Sanitized event sample
EventID: 5038
Computer: HOST01
File Name: C:\Windows\System32\drivers\bad.sys

Frequently Asked Questions

What does Windows Event ID 5038 mean?

Event ID 5038 records that Code Integrity found an invalid hash for an image being validated and identifies the file.

Does Event ID 5038 always indicate malware?

No. File corruption, storage errors, incomplete updates, and third-party software defects can also invalidate a hash or signature.

How should 5038 be investigated?

Validate FileName, signer and catalog status, file hash, recent writes, update timing, and related driver or service failures before containment.

Sources