Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)

title: Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)
id: 0eb0681f-4543-4404-ac89-7fbaa92fda7b
status: test
description: This rule flags Windows events from Code Integrity indicating that an unsigned kernel module was loaded into the system. Loading unsigned kernel modules is a high-risk behavior because it can enable attackers to run code in kernel mode, bypassing normal trust boundaries. The detection relies on Code Integrity Operational telemetry, specifically Event ID 3001.
references:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: codeintegrity-operational
detection:
  selection:
    EventID: 3001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 951f8d29-f2f6-48a7-859f-0673ff105e6f
    type: derived