Detectionhightest

CodeIntegrity - Revoked Kernel Driver Loaded

Detects the load of a revoked kernel driver

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue Jun 06320fccbf-5e32-4101-82b8-2679c5f007c6windows

Log Source

Windowscodeintegrity-operational

ProductWindows← raw: windows

Servicecodeintegrity-operational← raw: codeintegrity-operational

Detection Logic

detection:
    selection:
        EventID:
            - 3021 # Code Integrity determined a revoked kernel module %2 is loaded into the system.  Check with the publisher to see if a new signed version of the kernel module is available.
            - 3022 # Code Integrity determined a revoked kernel module %2 is loaded into the system. The image is allowed to load because kernel mode debugger is attached.
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics