SOC Event Lookup
Event ID 5038CodeIntegrityP2

Windows Event ID 5038: Code integrity determined image hash is not valid

Windows Security Event ID 5038 records Code Integrity rejecting a file because its image hash is not valid.

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-13

Trigger Scenarios

This event is generated by Code Integrity when a file signature is not valid, including unauthorized modification or disk/device error conditions.

Key Fields

File Name

The path of the file whose image hash was not valid. Microsoft documents the schema as File Name: %filepath\filename%.

Computer

Identifies the host where an unsigned, modified, or corrupt driver or system file attempted to load.

Code Integrity context

Microsoft notes Code Integrity validates driver or system file integrity each time loaded into memory, and x64 kernel-mode drivers must be digitally signed.

Common False Positives

  • Microsoft notes disk device error or file corruption can produce this event.
  • Broken third-party driver updates can create repeated 5038 events until the vendor package is repaired.

Related Events

MITRE ATT&CK Mapping

  • T1553.002Subvert Trust Controls: Code Signing

Detection Notes

Alert when File Name is under C:\Windows\System32\drivers, C:\Windows\System32, or a security product directory and the file is unsigned, newly modified, or appears immediately before service or driver failure. Microsoft documents Event 5038 as invalid image hash/signature telemetry and states Code Integrity checks drivers or system files as they load; this supports T1553.002 Code Signing when an attacker tampers with a signed trust path or loads modified code. Correlate with 5035, driver-load telemetry, file-write events, and vendor update timing before containment.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 5038
| project TimeGenerated, Computer, Account
Splunk SPL
index=wineventlog EventCode=5038 | table _time, host
Sample Log
EventID: 5038
Computer: HOST01
File Name: C:\Windows\System32\drivers\bad.sys

Source

Official documentationMachine-readable JSON