Windows Code Integrity: Kernel Module Loaded Despite Unmet WHQL Requirements (Event 3082/3083)

title: "Windows Code Integrity: Kernel Module Loaded Despite Unmet WHQL Requirements (Event 3082/3083)"
id: b8b2e1d4-f90e-451e-baa5-d542ed0c1ee3
status: test
description: This rule flags Windows systems where Code Integrity reports that a loaded kernel module did not meet WHQL signing requirements. Attackers may attempt to load non-compliant kernel modules to gain high-privilege execution, persistence, or tamper with kernel behavior. The detection relies on Code Integrity Operational telemetry for Event IDs 3082 and 3083, and filters out specific optional VMware driver paths.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
modified: 2023-06-14
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID:
      - 3082
      - 3083
  filter_optional_vmware:
    FileNameBuffer:
      - system32\drivers\vsock.sys
      - System32\drivers\vmci.sys
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f
    type: derived