Event ID 3001 — Code Integrity determined an unsigned kernel module FileNameBuffer is loaded into the system.
Description
Code Integrity determined an unsigned kernel module FileNameBuffer is loaded into the system. Check with the publisher to see if a signed version of the kernel module is available.
Message #
Fields #
| Name | Description |
|---|---|
FileNameLength UInt16 | — |
FileNameBuffer UnicodeString | — |
SecureRequired HexInt32 | — |
RequestedSigningLevel UInt8 | — |
ProcessNameLength UInt16 | — |
ProcessNameBuffer UnicodeString | — |
Detection Rules #
View all rules referencing this event →
Sigma # view in reference
- CodeIntegrity - Unsigned Kernel Module Loaded source high: Detects the presence of a loaded unsigned kernel module on the system.