Windows Code Integrity: Revoked Kernel Driver Loaded (Event 3021/3022)
Alerts when Windows Code Integrity reports a revoked kernel driver/module loaded (including debugger-allowed cases) via Event IDs 3021/3022.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule flags Windows Code Integrity operational events indicating a revoked kernel module/driver was loaded. Attackers may attempt to retain or use known-compromised drivers to maintain persistence or escalate privileges despite signature-based controls. The detection relies on CodeIntegrity-Operational telemetry containing EventID 3021 or 3022, which describe whether the revoked module was allowed due to a kernel-mode debugger attachment.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-operational-revoked-kernel-driver-loaded-event-id-3021-30-320fccbf
title: "Windows Code Integrity: Revoked Kernel Driver Loaded (Event 3021/3022)"
id: eabf2ad2-933d-456f-87f2-7283b6d0e142
status: test
description: This rule flags Windows Code Integrity operational events indicating a revoked kernel module/driver was loaded. Attackers may attempt to retain or use known-compromised drivers to maintain persistence or escalate privileges despite signature-based controls. The detection relies on CodeIntegrity-Operational telemetry containing EventID 3021 or 3022, which describe whether the revoked module was allowed due to a kernel-mode debugger attachment.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID:
- 3021
- 3022
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 320fccbf-5e32-4101-82b8-2679c5f007c6
type: derived