Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)
Alerts on Windows Code Integrity reporting an unsigned kernel module load via Event ID 3001.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- codeintegrity-operational
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-06
- Updated
- 2026-07-31
What it detects
This rule flags Windows events indicating Code Integrity has loaded an unsigned kernel module into the system. Attackers may abuse unsigned or improperly signed kernel modules to bypass trust controls and gain elevated capabilities at the kernel level. The detection relies on Code Integrity Operational telemetry reporting Event ID 3001, including the module information provided in the event.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal ResearchInternal Research
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-integrity-unsigned-kernel-module-loaded-event-id-3001-951f8d29
title: Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)
id: 0eb0681f-4543-4404-ac89-7fbaa92fda7b
status: test
description: This rule flags Windows events indicating Code Integrity has loaded an unsigned kernel module into the system. Attackers may abuse unsigned or improperly signed kernel modules to bypass trust controls and gain elevated capabilities at the kernel level. The detection relies on Code Integrity Operational telemetry reporting Event ID 3001, including the module information provided in the event.
references:
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-06
tags:
- attack.privilege-escalation
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID: 3001
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 951f8d29-f2f6-48a7-859f-0673ff105e6f
type: derived