Unmet WHQL Requirements For Loaded Kernel Module
Detects when a kernel module that does not meet WHQL (Windows Hardware Quality Labs) signing requirements is loaded into the system. This can indicate the presence of unsigned or improperly signed drivers, which might be malicious or unstable. The rule specifically looks for Code Integrity Event IDs 3082 and 3083, which signify that such a module was loaded, even if allowed due to auditing policy.
Sigma
