Windows Code Integrity: Kernel Module Loaded Without WHQL Requirements (Event 3082/3083)
Alerts when Code Integrity logs show loaded kernel modules failing WHQL compliance (Event 3082/3083), excluding selected VMware drivers.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule identifies kernel modules that Code Integrity determines did not meet WHQL signing requirements after being loaded into the system. Attackers may try to introduce or load non-compliant kernel components to gain privileged execution, so flagging these events can highlight trust boundary violations. It relies on Windows Code Integrity operational telemetry for Event ID 3082 and 3083 and applies an exclusion for specific VMware driver filenames.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-kernel-module-loaded-despite-unmet-whql-requirements-even-2f8cd7a0
title: "Windows Code Integrity: Kernel Module Loaded Without WHQL Requirements (Event 3082/3083)"
id: b8b2e1d4-f90e-451e-baa5-d542ed0c1ee3
status: test
description: This rule identifies kernel modules that Code Integrity determines did not meet WHQL signing requirements after being loaded into the system. Attackers may try to introduce or load non-compliant kernel components to gain privileged execution, so flagging these events can highlight trust boundary violations. It relies on Windows Code Integrity operational telemetry for Event ID 3082 and 3083 and applies an exclusion for specific VMware driver filenames.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
modified: 2023-06-14
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID:
- 3082
- 3083
filter_optional_vmware:
FileNameBuffer:
- system32\drivers\vsock.sys
- System32\drivers\vmci.sys
condition: selection and not 1 of filter_optional_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f
type: derived