CodeIntegrity Event 3033 spam: engine repeatedly tries to inject into processes with signed-image mitigation policies

When Windhawk runs with its default global injection configuration, processes that enforce Microsoft signed-image mitigation policies (e.g. Chrome-based browsers like Helium/Brave, some svchost.exe instances) repeatedly attempt to load windhawk.dll, fail the signing level check, and generate CodeIntegrity Event ID 3033 entries in Microsoft-Windows-CodeIntegrity/Operational.

On my system this produced ~150+ events within minutes of boot:

Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\imput\Helium\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Windhawk\Engine\1.7.3_1\64\windhawk.dll that did not meet the Microsoft signing level requirements.

The DLL load always fails (the process is never modified), but Windhawk keeps retrying on every relevant process start, flooding the event log. This also makes legitimate security auditing harder, since real CodeIntegrity events get buried under noise.

Environment

• Windhawk version: 1.7.3_1 (valid signature)
• OS: Windows 11 26H1
• Mods installed: start-menu-open-location, win-d-per-monitor (both target explorer.exe only)

Current workaround

Setting the engine advanced settings to include-only mode stops the noise completely:

HKLM\SOFTWARE\Windhawk\Engine\Settings Include = explorer.exe Exclude = *

After restarting Windhawk, zero new 3033 events are logged, and both explorer-targeted mods continue working fine.

Suggestion 1: Detect and skip mitigated processes

Would it be possible for the engine to detect that a target process has an image-load mitigation policy restricting DLLs to Microsoft-signed images (or detect the repeated ERROR_INVALID_IMAGE_HASH load failure) and skip injection attempts into such processes automatically? Alternatively, suppressing retries after the first failure per executable path would already eliminate most of the log spam.

Suggestion 2: Opt-in whitelist as a safer default model

My mods only need explorer.exe, yet by default the engine attempts injection into every new process. An opt-in model would fit Windhawk's architecture well:

• Each mod already declares its target processes via its Include field.
• The engine could derive a union of all enabled mods' Include targets and restrict global injection to that set automatically (unless the user explicitly overrides it).
• Users who genuinely want all-process injection (e.g. for wildcard-target mods) could keep the current behavior via an explicit setting.

This would reduce event log noise and antivirus/EDR friction by default, while keeping full flexibility for power users. Thanks for the great tool!