From this blog article:
Windows PKI Internals (Signing Levels, Scenarios, Root Keys, EKUs & Runtime Signers).
Windows 8 instituted the Signing Level, also sometimes referred to as the Signature Level. This undocumented number was a way for the system to differentiate the different types of Windows binaries, something that became a requirement for Windows RT as part of its requirement to prohibit the execution of Windows “desktop” applications.
How this signature level are determined on what basis ? Is that flag passed to CreateProcess or kernel handles this ?