Windows Code Integrity Operational: Revoked Kernel Driver Loaded (Event ID 3021/3022)

title: "Windows Code Integrity Operational: Revoked Kernel Driver Loaded (Event ID 3021/3022)"
id: eabf2ad2-933d-456f-87f2-7283b6d0e142
status: test
description: This rule flags Windows Code Integrity events indicating a revoked kernel-mode driver/module was loaded. Such activity matters because attackers may try to use vulnerable or previously blocked drivers to gain elevated capabilities or evade trust enforcement. It relies on Code Integrity Operational telemetry for Event ID 3021 (revoked module loaded) and Event ID 3022 (revoked module allowed when a kernel debugger is attached).
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID:
      - 3021
      - 3022
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 320fccbf-5e32-4101-82b8-2679c5f007c6
    type: derived