Log Name:      Microsoft-Windows-CodeIntegrity/Operational
Source:        Microsoft-Windows-CodeIntegrity
Date:          17/09/2021 09:30:23
Event ID:      3076
Task Category: (18)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      IPC-3
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\63a9333b18a8e0e6429611a62a1c1094\Microsoft.SecureBoot.Commands.ni.dll that did not meet the Enterprise signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CodeIntegrity" Guid="{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}" />
    <EventID>3076</EventID>
    <Version>4</Version>
    <Level>4</Level>
    <Task>18</Task>
    <Opcode>118</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-17T09:30:23.960592200Z" />
    <EventRecordID>36453</EventRecordID>
    <Correlation ActivityID="{794c30e9-aba4-0002-7246-4c79a4abd701}" />
    <Execution ProcessID="4176" ThreadID="1236" />
    <Channel>Microsoft-Windows-CodeIntegrity/Operational</Channel>
    <Computer>IPC-3</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FileNameLength">158</Data>
    <Data Name="File Name">\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\63a9333b18a8e0e6429611a62a1c1094\Microsoft.SecureBoot.Commands.ni.dll</Data>
    <Data Name="ProcessNameLength">78</Data>
    <Data Name="Process Name">\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="Requested Signing Level">2</Data>
    <Data Name="Validated Signing Level">2</Data>
    <Data Name="Status">0xc0e90002</Data>
    <Data Name="SHA1 Hash Size">20</Data>
    <Data Name="SHA1 Hash">CD81FA9367106ED24F773944B53CE83A86D18844</Data>
    <Data Name="SHA256 Hash Size">32</Data>
    <Data Name="SHA256 Hash">DBFDFC1AD77AF4E30D99389BEB0A8C318BFD44318ACFB05B404B43EAFA909A50</Data>
    <Data Name="SHA1 Flat Hash Size">20</Data>
    <Data Name="SHA1 Flat Hash">46DAAA945C9A67B1CEFF7EA2E2DFD78725362C4C</Data>
    <Data Name="SHA256 Flat Hash Size">32</Data>
    <Data Name="SHA256 Flat Hash">DF8C52A0E2E2141B4461623E699B3EE57020F27EAD97D9140F859B84E0A96967</Data>
    <Data Name="USN">595221704</Data>
    <Data Name="SI Signing Scenario">1</Data>
    <Data Name="PolicyNameLength">7</Data>
    <Data Name="PolicyName">Default</Data>
    <Data Name="PolicyIDLength">7</Data>
    <Data Name="PolicyID">Default</Data>
    <Data Name="PolicyHashSize">32</Data>
    <Data Name="PolicyHash">9798994F23397C90BCA569EC4B7CF90F9ADDCD831A8A857C355DC657F491731E</Data>
    <Data Name="OriginalFileNameLength">33</Data>
    <Data Name="OriginalFileName">Microsoft.SecureBoot.Commands.dll</Data>
    <Data Name="InternalNameLength">33</Data>
    <Data Name="InternalName">Microsoft.SecureBoot.Commands.dll</Data>
    <Data Name="FileDescriptionLength">1</Data>
    <Data Name="FileDescription">
    </Data>
    <Data Name="ProductNameLength">42</Data>
    <Data Name="ProductName">Microsoft (R) Windows (R) Operating System</Data>
    <Data Name="FileVersion">10.0.17763.1</Data>
  </EventData>
</Event>


Log Name:      Microsoft-Windows-CodeIntegrity/Operational
Source:        Microsoft-Windows-CodeIntegrity
Date:          17/09/2021 09:30:23
Event ID:      3076
Task Category: (18)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      IPC-3
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\63a9333b18a8e0e6429611a62a1c1094\Microsoft.SecureBoot.Commands.ni.dll that did not meet the Enterprise signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CodeIntegrity" Guid="{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}" />
    <EventID>3076</EventID>
    <Version>4</Version>
    <Level>4</Level>
    <Task>18</Task>
    <Opcode>118</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-09-17T09:30:23.960592200Z" />
    <EventRecordID>36453</EventRecordID>
    <Correlation ActivityID="{794c30e9-aba4-0002-7246-4c79a4abd701}" />
    <Execution ProcessID="4176" ThreadID="1236" />
    <Channel>Microsoft-Windows-CodeIntegrity/Operational</Channel>
    <Computer>IPC-3</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FileNameLength">158</Data>
    <Data Name="File Name">\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S1bc92e04#\63a9333b18a8e0e6429611a62a1c1094\Microsoft.SecureBoot.Commands.ni.dll</Data>
    <Data Name="ProcessNameLength">78</Data>
    <Data Name="Process Name">\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="Requested Signing Level">2</Data>
    <Data Name="Validated Signing Level">2</Data>
    <Data Name="Status">0xc0e90002</Data>
    <Data Name="SHA1 Hash Size">20</Data>
    <Data Name="SHA1 Hash">CD81FA9367106ED24F773944B53CE83A86D18844</Data>
    <Data Name="SHA256 Hash Size">32</Data>
    <Data Name="SHA256 Hash">DBFDFC1AD77AF4E30D99389BEB0A8C318BFD44318ACFB05B404B43EAFA909A50</Data>
    <Data Name="SHA1 Flat Hash Size">20</Data>
    <Data Name="SHA1 Flat Hash">46DAAA945C9A67B1CEFF7EA2E2DFD78725362C4C</Data>
    <Data Name="SHA256 Flat Hash Size">32</Data>
    <Data Name="SHA256 Flat Hash">DF8C52A0E2E2141B4461623E699B3EE57020F27EAD97D9140F859B84E0A96967</Data>
    <Data Name="USN">595221704</Data>
    <Data Name="SI Signing Scenario">1</Data>
    <Data Name="PolicyNameLength">7</Data>
    <Data Name="PolicyName">Default</Data>
    <Data Name="PolicyIDLength">7</Data>
    <Data Name="PolicyID">Default</Data>
    <Data Name="PolicyHashSize">32</Data>
    <Data Name="PolicyHash">9798994F23397C90BCA569EC4B7CF90F9ADDCD831A8A857C355DC657F491731E</Data>
    <Data Name="OriginalFileNameLength">33</Data>
    <Data Name="OriginalFileName">Microsoft.SecureBoot.Commands.dll</Data>
    <Data Name="InternalNameLength">33</Data>
    <Data Name="InternalName">Microsoft.SecureBoot.Commands.dll</Data>
    <Data Name="FileDescriptionLength">1</Data>
    <Data Name="FileDescription">
    </Data>
    <Data Name="ProductNameLength">42</Data>
    <Data Name="ProductName">Microsoft (R) Windows (R) Operating System</Data>
    <Data Name="FileVersion">10.0.17763.1</Data>
  </EventData>
</Event>