5038 Security log · System Integrity high severity low volume

Windows Event ID 5038 — Code integrity determined that the image hash of a file is not valid

Code Integrity (CI) detected a file with an invalid or non-matching hash. FileName is key.

Why event 5038 matters

Rootkit or malware tampering with signed system files. Invalid hash of a Windows system file indicates either corruption or replacement with a malicious version (T1014). Also triggered by some legitimate unsigned software.

How to detect it

Alert: invalid hash on Windows system files (System32, SysWOW64). Investigate FileName — system files should always have valid hashes.

Log source
Security
Advanced Audit Policy — enable the 'System Integrity' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Defense Evasion Rootkit (T1014)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 5038   // Code integrity determined that the image hash of a file is not valid
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5038
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Code integrity determined that the image hash of a file is not valid — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5038 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Windows Event ID 5038?

Code integrity determined that the image hash of a file is not valid. Code Integrity (CI) detected a file with an invalid or non-matching hash. FileName is key.

Which log records event 5038?

Event 5038 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System Integrity' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5038?

Event 5038 is associated with: Rootkit (T1014).

How do you detect activity around event 5038?

Alert: invalid hash on Windows system files (System32, SysWOW64). Investigate FileName — system files should always have valid hashes.