ASP.NET ViewState Verification Failure

Tim Peck@timpeck

•updated May 25, 2026•1•0•258

This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.