| Previous | Next |
| STATUS_VALID_CATALOG_HASH | STATUS_GHOSTED |
STATUS_VALID_STRONG_CODE_HASH
The accepted digest satisfies strong code-integrity requirements
This success status is more specific than a generic valid-image result: the accepted file hash uses a combination considered strong by the Code Integrity path that evaluated it. The exact policy can depend on operating-system version, signing configuration, certificate capabilities, and rules that reject legacy digest algorithms.
The word strong should not be converted into an assumption about the whole software supply chain. It describes the hash/signing property recognized at this stage. Publisher trust, certificate validity, revocation, catalog installation, vulnerable-driver policy, and runtime mitigations remain separate controls.
What to inspect
- Capture the digest and signature algorithms, signer certificate, timestamp countersignature, and policy identifier.
- Check whether the verifier accepted an embedded signature, catalog member, or explicit hash rule.
- Compare the result with the effective App Control policy and any minimum hash-strength requirements.
- Do not replace the original evidence with a newly signed copy when investigating why an earlier image was accepted.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: App Control file rule and Authenticode hashes
- Microsoft: SignTool
- IETF RFC 5280: certificate and CRL profile
Looking for a different code? Search another status or error code.