WDAC File Rule Level: WHQLFilePublisher#

The most specific WHQL-family rule level: combines the WHQL EKU trust check, vendor leaf certificate CN, specific driver filename, and a minimum version floor — granting surgical, version-gated trust for exactly the kernel drivers you have inventoried.

Table of Contents#

Overview
The Triple Binding Concept
How WHQLFilePublisher Works Technically
The WHQLFilePublisher Trust Check Flow
OriginalFileName and -SpecificFileNameLevel
Certificate Chain / Trust Anatomy
Where in the Evaluation Stack
XML Representation — Full Example
PowerShell Examples
All Four WHQL Levels — Trust Surface Comparison
Pros & Cons Table
Attack Resistance Analysis
When to Use vs. When to Avoid — Decision Flowchart
Real-World Scenario: Intel NIC Driver Allowlisting
Policy Maintenance: Driver Updates
OS Version & Compatibility
Common Mistakes & Gotchas
Summary Table

1. Overview#

WHQLFilePublisher is the most specific level in the WHQL family and one of the most commonly used levels in production-grade kernel driver allowlisting. It establishes trust through four simultaneous conditions that must all be satisfied:

WHQL EKU: The file’s certificate chain contains the Windows Hardware Quality Lab EKU (OID 1.3.6.1.4.1.311.10.3.5) — Microsoft certified this driver
Vendor CN: The leaf certificate’s Common Name matches a specific hardware vendor
Filename: The file’s internal OriginalFileName (from the PE VERSIONINFO resource) matches a specific value
Minimum Version: The file’s internal FileVersion is greater than or equal to a specified floor

This combination creates a rule that means: “Trust this specific driver file, from this specific vendor, as certified by Microsoft, at this version or above.” It is surgically precise without being brittle — the version floor ensures that driver updates automatically pass the rule without policy changes.

Default real-world use: In a corporate environment managing Intel network adapter drivers, a WHQLFilePublisher rule for e1d68x64.sys means only that specific Intel driver file (at or above the minimum version the admin approved) will be allowed. An attacker cannot substitute a different driver, even a WHQL-certified one from Intel, unless it has the same filename.

2. The Triple Binding Concept#

The name “triple binding” reflects that the rule simultaneously binds three distinct attributes:

1
WHQLFilePublisher = WHQL EKU binding
2
                  + Publisher (vendor CN) binding
3
                  + File attribute (name + version) binding

This is analogous to the relationship between PcaCertificate, Publisher, and FilePublisher in the standard non-WHQL levels — except that the entire chain must additionally pass the WHQL EKU check.

Level Family	Cert EKU	Vendor CN	Filename	Version Floor
PcaCertificate	—	—	—	—
Publisher	—	Yes	—	—
FilePublisher	—	Yes	Yes	Yes
WHQL	WHQL OID	—	—	—
WHQLPublisher	WHQL OID	Yes	—	—
WHQLFilePublisher	WHQL OID	Yes	Yes	Yes

Each step adds a constraint that reduces the trust surface. WHQLFilePublisher has all constraints active simultaneously.

3. How WHQLFilePublisher Works Technically#

When ci.dll evaluates a kernel driver against a WHQLFilePublisher rule, it performs these checks in sequence:

Step 1: Kernel-Mode Context Check#

The file must be loading in a kernel-mode context (device driver loader, IoLoadDriver). User-mode binaries fall into a different evaluation path.

Step 2: WHQL EKU Scan#

Walk the certificate chain from the leaf certificate toward the root. At each certificate, examine the Extended Key Usage extension. If OID 1.3.6.1.4.1.311.10.3.5 is not found anywhere in the chain, the rule does not match — evaluation falls through to the next rule.

Step 3: Chain Integrity Check#

Verify the chain roots in a Microsoft WHQL root (Microsoft Product Root 2010 or Microsoft Code Verification Root). This prevents spoofed WHQL EKUs from non-Microsoft CAs.

Step 4: Leaf CN Match#

Extract the Common Name (CN) from the leaf certificate’s subject. Compare it (case-sensitive, exact match) against the <CertPublisher Value="..."> in the WDAC rule. Mismatch = rule does not match.

Step 5: OriginalFileName Match#

Read the PE VERSIONINFO resource from the file binary itself. Extract the OriginalFileName string. Compare it against the <FileAttrib FileName="..."> value in the WDAC rule. Mismatch = rule does not match.

Note: This is the OriginalFileName embedded at compile time in the PE resource block, not the filename of the file on disk. A renamed file still carries its original compiled-in filename.

Step 6: Minimum Version Check#

Read the FileVersion from the PE VERSIONINFO resource. The WDAC rule specifies a MinimumFileVersion (four-part: major.minor.build.revision). If the file’s version is strictly less than the minimum, the rule does not match. Equal or greater passes.

If all six checks pass, the file is allowed. This multi-check evaluation is why WHQLFilePublisher provides the strongest trust guarantees while remaining maintainable.

4. The WHQLFilePublisher Trust Check Flow#

1
flowchart TD
2
    START(["Kernel driver load:\ne1d68x64.sys\nby Intel, WHQL-signed\nv12.18.9.23"]):::node
3

4
    KERNEL{"Kernel-mode\nloading context?"}:::node
5
    NOT_KERNEL["User-mode evaluation\napplies different rules"]:::node
6

7
    EKU_SCAN{"WHQL EKU (OID .311.10.3.5)\nfound in cert chain?"}:::node
8
    EKU_FAIL(["EKU not found\n→ Rule does not match\n→ Try next rule"]):::block
9

10
    CHAIN_ROOT{"Chain roots in\nMicrosoft WHQL root CA?"}:::node
11
    CHAIN_FAIL(["Root not trusted\n→ Rule does not match\n→ Try next rule"]):::block
12

13
    CN_CHECK{"Leaf cert CN =\n'Intel Corporation'?\n(must match exactly)"}:::node
14
    CN_FAIL(["CN mismatch\n→ Rule does not match\n→ Try next rule"]):::block
15

16
    FN_CHECK{"OriginalFileName =\n'e1d68x64.sys'?\n(from PE VERSIONINFO)"}:::node
17
    FN_FAIL(["Filename mismatch\n→ Rule does not match\n→ Try next rule"]):::block
18

19
    VER_CHECK{"FileVersion ≥\nMinimumFileVersion\n(e.g., 12.18.0.0)?"}:::node
20
    VER_FAIL(["Version too old\n→ Rule does not match\n→ Try next rule"]):::block
21

22
    ALL_PASS(["ALL CHECKS PASS\n→ ALLOWED\nDriver loads successfully"]):::allow
23

24
    START --> KERNEL
25
    KERNEL -->|"Yes"| EKU_SCAN
26
    KERNEL -->|"No"| NOT_KERNEL
27
    EKU_SCAN -->|"EKU present"| CHAIN_ROOT
28
    EKU_SCAN -->|"EKU absent"| EKU_FAIL
29
    CHAIN_ROOT -->|"Trusted root"| CN_CHECK
30
    CHAIN_ROOT -->|"Unknown root"| CHAIN_FAIL
31
    CN_CHECK -->|"CN matches"| FN_CHECK
32
    CN_CHECK -->|"CN differs"| CN_FAIL
33
    FN_CHECK -->|"Filename matches"| VER_CHECK
34
    FN_CHECK -->|"Filename differs"| FN_FAIL
35
    VER_CHECK -->|"Version ≥ minimum"| ALL_PASS
36
    VER_CHECK -->|"Version < minimum"| VER_FAIL
37

38
    classDef node fill:#162032,stroke:#1e3a5f,color:#e2e8f0
39
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac
40
    classDef block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5

Each failed check causes the rule to be skipped (the file evaluation continues to the next applicable rule). If no rule matches, the file reaches the policy’s default action.

5. OriginalFileName and -SpecificFileNameLevel#

By default, WHQLFilePublisher uses the OriginalFileName attribute from the PE VERSIONINFO resource. However, the PowerShell New-CIPolicy cmdlet supports the -SpecificFileNameLevel parameter to change which VERSIONINFO attribute is used:

`-SpecificFileNameLevel` Value	Attribute Used	Notes
`OriginalFileName` (default)	`OriginalFileName` in VERSIONINFO	Stable across disk renames
`InternalName`	`InternalName` in VERSIONINFO	Often same as OriginalFileName
`FileDescription`	`FileDescription` in VERSIONINFO	Human-readable, may change across versions
`ProductName`	`ProductName` in VERSIONINFO	Product-level grouping
`PackageFamilyName`	AppX package family name	For packaged apps (not typical for kernel drivers)

For kernel drivers, OriginalFileName is almost always the correct choice. It is:

Embedded at compile time (resistant to disk-level renaming attacks)
Stable across minor driver updates
Specific to the driver binary (not shared across product lines)

Renaming Attack Resistance#

Using OriginalFileName rather than the file’s name on disk provides an important security property: even if an attacker renames e1d68x64.sys to ntfs.sys (attempting to masquerade as a system file), the OriginalFileName embedded in the PE binary remains e1d68x64.sys. The WDAC rule would still correctly identify it. Conversely, a real ntfs.sys system file would not match an e1d68x64.sys rule even if placed at the expected path.

6. Certificate Chain / Trust Anatomy#

1
graph TB
2
    subgraph "Full Certificate Chain — WHQLFilePublisher Matching Points"
3
        ROOT["Microsoft Product Root 2010\n(Chain integrity check — must root here)"]:::root
4

5
        PCA["Microsoft Windows Hardware\nCompatibility PCA 2021\n(Intermediate — TBS hash in Signer CertRoot)"]:::pca
6

7
        LEAF["Microsoft-issued Leaf Certificate\nCN=Intel Corporation ← WHQLPublisher CN check\nEKU: 1.3.6.1.4.1.311.10.3.5 ← WHQL EKU check\nSerial: AA:BB:CC:DD:EE:FF"]:::pca
8

9
        FILE["e1d68x64.sys\nOriginalFileName: e1d68x64.sys ← FileAttrib FileName check\nFileVersion: 12.18.9.23 ← MinimumFileVersion check\nSigned by Intel leaf cert via Microsoft WHQL process"]:::file
10
    end
11

12
    subgraph "WDAC WHQLFilePublisher Rule Components"
13
        EKU_DEF["EKU Definition\nID_EKU_WHQL\nValue: 010A2B0601040182370A0305"]:::allow
14
        SIGNER_DEF["Signer Definition\nCertRoot: PCA TBS hash\nCertEKU: → EKU Definition\nCertPublisher: 'Intel Corporation'\nFileAttribRef: → FileAttrib"]:::allow
15
        FILEATTR_DEF["FileAttrib Definition\nFileName: 'e1d68x64.sys'\nMinimumFileVersion: '12.18.0.0'"]:::allow
16
    end
17

18
    ROOT --> PCA
19
    PCA --> LEAF
20
    LEAF --> FILE
21
    FILE -.->|"OriginalFileName + FileVersion"| FILEATTR_DEF
22
    LEAF -.->|"CN match"| SIGNER_DEF
23
    LEAF -.->|"EKU check"| EKU_DEF
24
    EKU_DEF -.->|"referenced by"| SIGNER_DEF
25
    FILEATTR_DEF -.->|"referenced by"| SIGNER_DEF
26

27
    classDef root fill:#1a0d2e,stroke:#6b21a8,color:#d8b4fe
28
    classDef pca fill:#162032,stroke:#1e3a5f,color:#e2e8f0
29
    classDef file fill:#162032,stroke:#1e3a5f,color:#e2e8f0
30
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac
31
    classDef block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5

The WHQLFilePublisher rule is more complex than single-element rules because it requires cross-referencing between three XML elements: the <EKU> definition, the <FileAttrib> definition, and the <Signer> that references both.

7. Where in the Evaluation Stack#

1
flowchart TD
2
    START(["Kernel Driver Load Request"]):::node
3

4
    HASH_CHECK{"Hash rule match?\n(most specific)"}:::node
5
    HASH_ALLOW(["ALLOWED — Hash match"]):::allow
6

7
    WFPUB_CHECK{"WHQLFilePublisher rule?\nEKU + CN + filename + version\n(most specific WHQL level)"}:::node
8
    WFPUB_ALLOW(["ALLOWED — WHQLFilePublisher match\nAll four conditions satisfied"]):::allow
9

10
    WPUB_CHECK{"WHQLPublisher rule?\nEKU + CN\n(vendor-specific WHQL)"}:::node
11
    WPUB_ALLOW(["ALLOWED — WHQLPublisher match"]):::allow
12

13
    WHQL_CHECK{"WHQL rule?\nEKU check only\n(any WHQL vendor)"}:::node
14
    WHQL_ALLOW(["ALLOWED — WHQL match"]):::allow
15

16
    FP_CHECK{"FilePublisher rule?\n(non-WHQL — CN + filename + version)"}:::node
17
    FP_ALLOW(["ALLOWED — FilePublisher match"]):::allow
18

19
    PUB_CHECK{"Publisher rule?\n(non-WHQL — CN only)"}:::node
20
    PUB_ALLOW(["ALLOWED — Publisher match"]):::allow
21

22
    PCA_CHECK{"PcaCertificate rule?"}:::node
23
    PCA_ALLOW(["ALLOWED — PcaCertificate match"]):::allow
24

25
    HASH_DENY_CHECK{"Hash deny rule?\n(explicit block)"}:::node
26
    DENY(["BLOCKED — Explicit deny\ntakes precedence"]):::block
27

28
    DEFAULT{"Default action?"}:::node
29
    BLOCK(["BLOCKED — Default deny"]):::block
30

31
    START --> HASH_DENY_CHECK
32
    HASH_DENY_CHECK -->|"Deny rule matches"| DENY
33
    HASH_DENY_CHECK -->|"No deny rule"| HASH_CHECK
34
    HASH_CHECK -->|"Yes"| HASH_ALLOW
35
    HASH_CHECK -->|"No"| WFPUB_CHECK
36
    WFPUB_CHECK -->|"Yes — all 4 conditions"| WFPUB_ALLOW
37
    WFPUB_CHECK -->|"No"| WPUB_CHECK
38
    WPUB_CHECK -->|"Yes"| WPUB_ALLOW
39
    WPUB_CHECK -->|"No"| WHQL_CHECK
40
    WHQL_CHECK -->|"Yes"| WHQL_ALLOW
41
    WHQL_CHECK -->|"No"| FP_CHECK
42
    FP_CHECK -->|"Yes"| FP_ALLOW
43
    FP_CHECK -->|"No"| PUB_CHECK
44
    PUB_CHECK -->|"Yes"| PUB_ALLOW
45
    PUB_CHECK -->|"No"| PCA_CHECK
46
    PCA_CHECK -->|"Yes"| PCA_ALLOW
47
    PCA_CHECK -->|"No"| DEFAULT
48
    DEFAULT -->|"DefaultDeny"| BLOCK
49

50
    classDef node fill:#162032,stroke:#1e3a5f,color:#e2e8f0
51
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac
52
    classDef block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5

WHQLFilePublisher is evaluated before WHQLPublisher and WHQL because it is more specific. If a policy contains all three levels of WHQL rules, and a file matches WHQLFilePublisher, evaluation stops immediately — the more general WHQL rules are never consulted. This is the standard WDAC specificity-first matching principle.

Deny rules always take precedence over allow rules regardless of level. This is how the Microsoft vulnerable driver block list works: even a file that would match a WHQLFilePublisher rule is blocked if a deny rule for its hash or signer exists.

8. XML Representation — Full Example#

A WHQLFilePublisher rule requires three coordinated XML elements plus a reference in the signing scenarios section. This is the most complex XML structure in the WHQL family.

1
<?xml version="1.0" encoding="utf-8"?>
2
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
3

4
  <!-- ═══════════════════════════════════════════════════════════
5
       SECTION 1: EKU Definitions
6
       Define the WHQL EKU OID value used across all WHQL rules
7
       ═══════════════════════════════════════════════════════════ -->
8
  <EKUs>
9
    <EKU ID="ID_EKU_WHQL" Value="010A2B0601040182370A0305" />
10
  </EKUs>
11

12
  <!-- ═══════════════════════════════════════════════════════════
13
       SECTION 2: File Attributes
14
       Define the filename + version floor for each specific driver
15
       Each WHQLFilePublisher rule needs a corresponding FileAttrib
16
       ═══════════════════════════════════════════════════════════ -->
17
  <FileRules>
18

19
    <!--
20
      FileAttrib for Intel NIC driver e1d68x64.sys
21
      OriginalFileName: matches the PE VERSIONINFO OriginalFileName field
22
      MinimumFileVersion: version floor — this version OR HIGHER passes
23
        - Format: Major.Minor.Build.Revision (four-part)
24
        - Driver versions AT OR ABOVE 12.18.0.0 will pass
25
        - Older driver versions will fail this check (blocked)
26
    -->
27
    <FileAttrib ID="ID_FILEATTRIB_INTEL_NIC_DRIVER"
28
                FriendlyName="Intel Ethernet Connection (I219-LM) Driver"
29
                FileName="e1d68x64.sys"
30
                MinimumFileVersion="12.18.0.0" />
31

32
    <!--
33
      FileAttrib for Intel Network Adapter Diagnostic Driver
34
      Separate entry needed per unique OriginalFileName
35
    -->
36
    <FileAttrib ID="ID_FILEATTRIB_INTEL_NIC_DIAG"
37
                FriendlyName="Intel Network Adapter Diagnostic Driver"
38
                FileName="IntelNA.sys"
39
                MinimumFileVersion="28.0.0.0" />
40

41
    <!--
42
      FileAttrib for NVIDIA GPU driver
43
      Note: NVIDIA uses a different vendor CN, so a separate Signer is needed
44
    -->
45
    <FileAttrib ID="ID_FILEATTRIB_NVIDIA_GPU"
46
                FriendlyName="NVIDIA Tesla/Quadro GPU Driver"
47
                FileName="nvlddmkm.sys"
48
                MinimumFileVersion="30.0.14.7212" />
49

50
  </FileRules>
51

52
  <!-- ═══════════════════════════════════════════════════════════
53
       SECTION 3: Signer Definitions
54
       One Signer per vendor/CN combination.
55
       Each Signer can reference multiple FileAttribRef elements
56
       (multiple driver files from the same vendor).
57
       ═══════════════════════════════════════════════════════════ -->
58
  <Signers>
59

60
    <!--
61
      WHQLFilePublisher Signer for Intel Corporation
62
      Allows ONLY the specific files listed in FileAttribRef elements below.
63
      If Intel releases a new driver filename not in this list, it is NOT allowed.
64
      The CertPublisher restricts to Intel's CN specifically.
65
    -->
66
    <Signer ID="ID_SIGNER_WHQL_FP_INTEL" Name="WHQLFilePublisher - Intel Corporation">
67

68
      <CertRoot Type="TBS" Value="3085A90B03EE71B6B33F5EA8A07DBBD40B5B7A89" />
69

70
      <CertEKU ID="ID_EKU_WHQL" />
71

72
      <CertPublisher Value="Intel Corporation" />
73

74
      <FileAttribRef RuleID="ID_FILEATTRIB_INTEL_NIC_DRIVER" />
75
      <FileAttribRef RuleID="ID_FILEATTRIB_INTEL_NIC_DIAG" />
76

77
    </Signer>
78

79
    <!--
80
      WHQLFilePublisher Signer for NVIDIA Corporation
81
      NVIDIA drivers get their own Signer because they have a different leaf CN
82
    -->
83
    <Signer ID="ID_SIGNER_WHQL_FP_NVIDIA" Name="WHQLFilePublisher - NVIDIA Corporation">
84
      <CertRoot Type="TBS" Value="3085A90B03EE71B6B33F5EA8A07DBBD40B5B7A89" />
85
      <CertEKU ID="ID_EKU_WHQL" />
86
      <CertPublisher Value="NVIDIA Corporation" />
87
      <FileAttribRef RuleID="ID_FILEATTRIB_NVIDIA_GPU" />
88
    </Signer>
89

90
  </Signers>
91

92
  <!-- ═══════════════════════════════════════════════════════════
93
       SECTION 4: Signing Scenarios
94
       Reference signers in the appropriate loading context
95
       ═══════════════════════════════════════════════════════════ -->
96
  <SigningScenarios>
97

98
    <SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_KERNEL" FriendlyName="Kernel Mode">
99
      <ProductSigners>
100
        <AllowedSigner SignerID="ID_SIGNER_WHQL_FP_INTEL" />
101
        <AllowedSigner SignerID="ID_SIGNER_WHQL_FP_NVIDIA" />
102
      </ProductSigners>
103
    </SigningScenario>
104

105
  </SigningScenarios>
106

107
  <!-- ═══════════════════════════════════════════════════════════
108
       SECTION 5: Policy Rules
109
       ═══════════════════════════════════════════════════════════ -->
110
  <Rules>
111
    <Rule>
112
      <Option>Required:WHQL</Option>
113
    </Rule>
114
    <Rule>
115
      <Option>Enabled:Unsigned System Integrity Policy</Option>
116
    </Rule>
117
  </Rules>
118

119
</SiPolicy>

XML Structure Summary#

XML Element	Role in WHQLFilePublisher
`<EKU ID Value>`	Defines the WHQL OID — shared across all WHQL rules
`<FileAttrib ID FileName MinimumFileVersion>`	Defines file-specific constraints (filename + version floor)
`<Signer ID>`	Ties together: PCA cert, EKU ref, vendor CN, and file attrib refs
`<CertRoot Type="TBS">`	TBS hash of the WHQL intermediate CA
`<CertEKU ID>`	References the EKU definition — requires WHQL OID in chain
`<CertPublisher Value>`	Vendor leaf CN — the WHQLPublisher component
`<FileAttribRef RuleID>`	Links to a FileAttrib — the FilePublisher component
`<AllowedSigner SignerID>`	Activates the Signer in the kernel-mode signing scenario

9. PowerShell Examples#

Generating WHQLFilePublisher Rules#

1
# Default: generates WHQLFilePublisher rules using OriginalFileName from PE VERSIONINFO
2
New-CIPolicy `
3
    -ScanPath "C:\Windows\System32\drivers\" `
4
    -Level WHQLFilePublisher `
5
    -Fallback Hash `
6
    -FilePath "C:\Policies\WHQLFilePublisher-Policy.xml" `
7
    -Drivers
8

9
# Output XML will contain:
10
# - EKU element for WHQL OID
11
# - FileAttrib elements for each unique driver filename found during scan
12
# - Signer elements combining PCA cert + EKU ref + vendor CN + FileAttribRef(s)

1
# Using -SpecificFileNameLevel to match on InternalName instead of OriginalFileName
2
# Useful when OriginalFileName is inconsistent across driver versions
3
New-CIPolicy `
4
    -ScanPath "C:\Windows\System32\drivers\" `
5
    -Level WHQLFilePublisher `
6
    -SpecificFileNameLevel InternalName `
7
    -Fallback Hash `
8
    -FilePath "C:\Policies\WHQLFilePublisher-InternalName.xml" `
9
    -Drivers

Extracting PE VERSIONINFO from a Driver#

1
function Get-WHQLFilePublisherInfo {
2
    param([string]$DriverPath)
3

4
    $whqlOid = "1.3.6.1.4.1.311.10.3.5"
5
    $file = [System.IO.FileInfo]$DriverPath
6

7
    # Get version info from the PE VERSIONINFO resource
8
    $versionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($DriverPath)
9

10
    # Get signature info
11
    $sig = Get-AuthenticodeSignature -FilePath $DriverPath
12
    if ($sig.Status -ne "Valid") {
13
        Write-Warning "Not validly signed: $DriverPath"
14
        return
15
    }
16

17
    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
18
    $chain.Build($sig.SignerCertificate) | Out-Null
19

20
    # Check for WHQL EKU
21
    $isWhql = $false
22
    $whqlCertSubject = ""
23
    foreach ($el in $chain.ChainElements) {
24
        foreach ($ext in $el.Certificate.Extensions) {
25
            if ($ext -is [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]) {
26
                if ($ext.EnhancedKeyUsages | Where-Object { $_.Value -eq $whqlOid }) {
27
                    $isWhql = $true
28
                    $whqlCertSubject = $el.Certificate.Subject
29
                }
30
            }
31
        }
32
    }
33

34
    # Leaf CN = CertPublisher value
35
    $leafCert = $chain.ChainElements[0].Certificate
36
    $cnMatch = $leafCert.Subject -match "CN=([^,]+)"
37
    $cn = if ($cnMatch) { $Matches[1].Trim() } else { "Unknown" }
38

39
    # Version = MinimumFileVersion value
40
    $fileVersion = "$($versionInfo.FileMajorPart).$($versionInfo.FileMinorPart).$($versionInfo.FileBuildPart).$($versionInfo.FilePrivatePart)"
41

42
    Write-Host "WHQLFilePublisher Info:" -ForegroundColor Cyan
43
    Write-Host "  File: $($file.Name)"
44
    Write-Host "  WHQL-Signed: $isWhql" -ForegroundColor $(if ($isWhql) { "Green" } else { "Red" })
45
    Write-Host ""
46
    Write-Host "  XML elements needed:"
47
    Write-Host ""
48
    Write-Host "  <EKU ID=`"ID_EKU_WHQL`" Value=`"010A2B0601040182370A0305`" />" -ForegroundColor Yellow
49
    Write-Host ""
50
    Write-Host "  <FileAttrib ID=`"ID_FILEATTRIB_$(($file.BaseName).ToUpper())`"" -ForegroundColor Yellow
51
    Write-Host "              FileName=`"$($versionInfo.OriginalFilename)`"" -ForegroundColor Yellow
52
    Write-Host "              MinimumFileVersion=`"$fileVersion`" />" -ForegroundColor Yellow
53
    Write-Host ""
54
    Write-Host "  <CertPublisher Value=`"$cn`" />" -ForegroundColor Yellow
55
    Write-Host "  (Inside a Signer element with CertRoot for the WHQL PCA and CertEKU ref)"
56
}
57

58
# Usage
59
Get-WHQLFilePublisherInfo -DriverPath "C:\Windows\System32\drivers\e1d68x64.sys"
60
Get-WHQLFilePublisherInfo -DriverPath "C:\Windows\System32\drivers\nvlddmkm.sys"

Scanning All WHQL Drivers and Generating a Complete Report#

1
# Audit all drivers in System32\drivers — build inventory for WHQLFilePublisher policy
2
$whqlOid = "1.3.6.1.4.1.311.10.3.5"
3
$results = [System.Collections.Generic.List[PSCustomObject]]::new()
4

5
Get-ChildItem "C:\Windows\System32\drivers\*.sys" | ForEach-Object {
6
    $driverFile = $_
7
    $sig = Get-AuthenticodeSignature -FilePath $driverFile.FullName -ErrorAction SilentlyContinue
8

9
    if ($sig -and $sig.Status -eq "Valid") {
10
        $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
11
        $chain.Build($sig.SignerCertificate) | Out-Null
12

13
        $isWhql = $false
14
        foreach ($el in $chain.ChainElements) {
15
            foreach ($ext in $el.Certificate.Extensions) {
16
                if ($ext -is [System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]) {
17
                    if ($ext.EnhancedKeyUsages | Where-Object { $_.Value -eq $whqlOid }) {
18
                        $isWhql = $true
19
                    }
20
                }
21
            }
22
        }
23

24
        if ($isWhql) {
25
            $leafCert = $chain.ChainElements[0].Certificate
26
            $cnMatch = $leafCert.Subject -match "CN=([^,]+)"
27
            $cn = if ($cnMatch) { $Matches[1].Trim() } else { "Unknown" }
28

29
            $vi = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($driverFile.FullName)
30
            $version = "$($vi.FileMajorPart).$($vi.FileMinorPart).$($vi.FileBuildPart).$($vi.FilePrivatePart)"
31

32
            $results.Add([PSCustomObject]@{
33
                DriverFile     = $driverFile.Name
34
                OriginalName   = $vi.OriginalFilename
35
                VendorCN       = $cn
36
                FileVersion    = $version
37
                FileDescription = $vi.FileDescription
38
                WHQL           = $true
39
            })
40
        }
41
    }
42
}
43

44
# Display results
45
$results | Sort-Object VendorCN, DriverFile | Format-Table -AutoSize
46

47
# Export for review
48
$results | Export-Csv "C:\Temp\WHQLDriverInventory.csv" -NoTypeInformation
49
Write-Host "Exported to C:\Temp\WHQLDriverInventory.csv"

Building a Policy from Scanned Driver Inventory#

1
# After scanning, generate the WHQLFilePublisher policy from the inventory
2
New-CIPolicy `
3
    -Level WHQLFilePublisher `
4
    -Fallback Hash `
5
    -FilePath "C:\Policies\Production-Drivers-WHQLFilePublisher.xml" `
6
    -Drivers `
7
    -ScanPath "C:\Windows\System32\drivers\"
8

9
# Convert to binary for deployment
10
ConvertFrom-CIPolicy `
11
    -XmlFilePath "C:\Policies\Production-Drivers-WHQLFilePublisher.xml" `
12
    -BinaryFilePath "C:\Policies\Production-Drivers-WHQLFilePublisher.p7b"
13

14
Write-Host "Policy ready for deployment:"
15
Write-Host "  XML: C:\Policies\Production-Drivers-WHQLFilePublisher.xml"
16
Write-Host "  Binary: C:\Policies\Production-Drivers-WHQLFilePublisher.p7b"

10. All Four WHQL Levels — Trust Surface Comparison#

This diagram illustrates how each successive WHQL level narrows the trust surface:

1
graph TD
2
    subgraph "WHQL — Broadest WHQL Level"
3
        W_RULE["Single WHQL Rule\nEKU check only"]:::warn
4
        W_COVER["Covers:\n• ALL WHQL-certified drivers\n• From ALL hardware vendors\n• ALL driver versions\n• ALL filenames\nEstimated trust surface:\n10,000+ drivers from 500+ vendors"]:::warn
5
    end
6

7
    subgraph "WHQLPublisher — Vendor-Scoped"
8
        WP_RULE["One rule per vendor\n(e.g., 5 rules for 5 vendors)\nEKU check + vendor CN check"]:::node
9
        WP_COVER["Covers:\n• ALL WHQL drivers from specified vendors\n• ALL driver versions from those vendors\n• ALL filenames from those vendors\nTrust surface:\nAll drivers from 5 vendors\n(hundreds of files)"]:::node
10
    end
11

12
    subgraph "WHQLFilePublisher — Most Specific"
13
        WFP_RULE["One rule per driver filename per vendor\n(e.g., 12 rules for 12 specific driver files)\nEKU check + vendor CN + filename + version floor"]:::allow
14
        WFP_COVER["Covers:\n• Specific named driver files\n• From specific named vendors\n• At minimum specified version\n• With WHQL certification\nTrust surface:\nExactly the 12 listed drivers\nat version >= minimum\n(very narrow)"]:::allow
15
    end
16

17
    subgraph "Hash — Narrowest (Not WHQL Family)"
18
        HASH_RULE["One rule per file hash\nNo certificates involved"]:::allow
19
        HASH_COVER["Covers:\n• Exactly one file\n• At exactly one version\n• Any change in content = new hash needed\nTrust surface:\nSingle file instance"]:::allow
20
    end
21

22
    W_RULE --> WP_RULE
23
    WP_RULE --> WFP_RULE
24
    WFP_RULE --> HASH_RULE
25

26
    W_COVER -.->|"Narrower"| WP_COVER
27
    WP_COVER -.->|"Narrower"| WFP_COVER
28
    WFP_COVER -.->|"Narrower"| HASH_COVER
29

30
    classDef warn fill:#1a1a0d,stroke:#7a6a00,color:#fde68a
31
    classDef node fill:#162032,stroke:#1e3a5f,color:#e2e8f0
32
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac

The right level depends on your operational context:

WHQL — broadest, easiest to maintain, highest risk, acceptable for general enterprise driver coverage
WHQLPublisher — vendor-scoped, moderate specificity, good for homogeneous hardware fleets
WHQLFilePublisher — most specific (excluding Hash), highest security, requires driver inventory, recommended for production policies
Hash — exact file pinning, maximum control, breaks on every update, only for long-lived static binaries

11. Pros & Cons Table#

Attribute	Assessment
Security level	Highest of all WHQL family levels
Trust scope	Precisely defined: specific file + vendor + certification + version floor
BYOVD resistance	Strong — attackers cannot use different filenames or older versions
Version management	Automatic: new versions of same driver pass automatically
Maintenance on driver update	Zero (if same filename, same vendor, new version ≥ minimum)
Maintenance on driver rename	Manual update required (new FileAttrib element)
Vendor CN change	Rule breaks — manual update required
Policy complexity	Higher XML verbosity — three coordinated elements per driver file
Initial setup effort	Requires driver inventory scan before policy creation
OEM fleet suitability	Excellent — precise control of exactly which drivers are permitted
Production readiness	Most production-appropriate of the WHQL levels
HVCI compatibility	Full — works identically under Hypervisor-Protected CI

12. Attack Resistance Analysis#

1
graph TD
2
    subgraph "Attack Vector Analysis vs. WHQLFilePublisher"
3

4
        A1["Attack: Load different vendor's\nvulnerable WHQL driver\n(e.g., Gigabyte CVE driver)"]:::warn
5
        R1{"WHQL EKU: Yes\nVendor CN: NOT in allowed list\nFilename: Not matching\nVersion: N/A"}:::node
6
        O1(["BLOCKED\nVendor CN check fails\nDifferent vendor not in allowlist"]):::allow
7

8
        A2["Attack: Load older vulnerable\nversion of allowed vendor driver\n(e.g., Intel NIC v10.0 with CVE)"]:::warn
9
        R2{"WHQL EKU: Yes\nVendor CN: Intel = match\nFilename: e1d68x64.sys = match\nVersion: 10.0 < 12.18.0.0 MINIMUM"}:::node
10
        O2(["BLOCKED\nVersion floor check fails\nOlder vulnerable version rejected"]):::allow
11

12
        A3["Attack: Use allowed driver\nbut with different filename\n(to evade filename-based blocks)"]:::warn
13
        R3{"WHQL EKU: Yes\nVendor CN: Intel = match\nFilename: intel_nic.sys ≠ e1d68x64.sys\nVersion: N/A"}:::node
14
        O3(["BLOCKED\nOriginalFileName check fails\nRenamed driver doesn't match any FileAttrib"]):::allow
15

16
        A4["Attack: Forge certificate with\nIntel CN but not from WHQL root"]:::warn
17
        R4{"WHQL EKU: Present (forged)\nChain root: NOT Microsoft WHQL root\nCN: Intel Corporation (forged)"}:::node
18
        O4(["BLOCKED\nChain integrity check fails\nMicrosoft WHQL root is not in chain"]):::allow
19

20
        A5["Attack: Update valid\nIntel driver with exploit code\nBut keep same filename + version"]:::warn
21
        R5{"WHQL EKU: Modified binary\n(signature invalidated)\nSignature invalid on tampered file"}:::node
22
        O5(["BLOCKED\nAuthenticode signature invalid\nFile modification breaks WHQL signature"]):::allow
23

24
        A6["Attack: Submit malicious driver to\nMicrosoft for WHQL certification\nunder same Intel filename"]:::warn
25
        R6{"Not possible without\nIntel's WHQL submission credentials\nMicrosoft's HLK testing\nwould detect malicious behavior"}:::node
26
        O6(["BLOCKED at submission level\nExtremely high barrier — requires\ncompromise of Intel's WHQL\nsubmission process"]):::allow
27
    end
28

29
    A1 --> R1 --> O1
30
    A2 --> R2 --> O2
31
    A3 --> R3 --> O3
32
    A4 --> R4 --> O4
33
    A5 --> R5 --> O5
34
    A6 --> R6 --> O6
35

36
    classDef node fill:#162032,stroke:#1e3a5f,color:#e2e8f0
37
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac
38
    classDef block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
39
    classDef warn fill:#1a1a0d,stroke:#7a6a00,color:#fde68a

WHQLFilePublisher addresses all six common attack vectors. The version floor (Attack 2) is particularly important for BYOVD mitigation: even if an attacker has a legitimate WHQL-signed copy of an allowed vendor’s driver with a CVE, the minimum version requirement prevents loading that older vulnerable copy.

13. When to Use vs. When to Avoid — Decision Flowchart#

1
flowchart TD
2
    Q1["Need to control kernel drivers\nin a production environment"]:::node
3

4
    Q2{"Have you done a\ndriver inventory of\nyour endpoints?"}:::node
5

6
    NO_INVENTORY["No driver inventory yet"]:::warn
7
    DO_INVENTORY["Step 1: Run audit mode policy\nwith WHQL level\nCollect Event 3076/3089 logs\nBuild driver inventory\nThen return here"]:::warn
8

9
    YES_INVENTORY["Driver inventory exists"]:::node
10

11
    Q3{"How many distinct\ndriver filenames?"}:::node
12

13
    SMALL_INVENTORY["< 50 distinct drivers\n(typical OEM fleet)"]:::node
14
    LARGE_INVENTORY["> 50 driver filenames\n(diverse hardware estate)"]:::node
15

16
    Q4{"Security requirement?"}:::node
17

18
    USE_WFPUB(["Use WHQLFilePublisher\nOne FileAttrib per driver filename\nOne Signer per vendor CN\nBest choice for production WDAC\nKernel driver control"]):::allow
19

20
    USE_WPUB(["Consider WHQLPublisher instead\nFewer rules to manage\nStill vendor-scoped\nAcceptable security for most enterprises"]):::warn
21

22
    Q5{"Specific concern about\nold vulnerable driver\nversions from allowed vendors?"}:::node
23

24
    ADD_VERSION(["Set MinimumFileVersion in FileAttrib\nto exclude known-vulnerable versions\nWHQLFilePublisher is the right level"]):::allow
25

26
    COMBINE_BLOCK(["Use WHQLPublisher level\n+ Microsoft block rules\nfor explicitly known-vulnerable drivers"]):::warn
27

28
    Q1 --> Q2
29
    Q2 -->|"No"| NO_INVENTORY
30
    NO_INVENTORY --> DO_INVENTORY
31
    Q2 -->|"Yes"| YES_INVENTORY
32
    YES_INVENTORY --> Q3
33
    Q3 -->|"Small"| SMALL_INVENTORY
34
    Q3 -->|"Large"| LARGE_INVENTORY
35
    SMALL_INVENTORY --> Q4
36
    LARGE_INVENTORY --> USE_WPUB
37
    Q4 -->|"High security/hardened"| USE_WFPUB
38
    Q4 -->|"Version control needed"| Q5
39
    Q5 -->|"Yes — set version floor"| ADD_VERSION
40
    Q5 -->|"No — any version fine"| COMBINE_BLOCK
41

42
    classDef node fill:#162032,stroke:#1e3a5f,color:#e2e8f0
43
    classDef allow fill:#0d1f12,stroke:#1a5c2a,color:#86efac
44
    classDef block fill:#1f0d0d,stroke:#7f1d1d,color:#fca5a5
45
    classDef warn fill:#1a1a0d,stroke:#7a6a00,color:#fde68a

14. Real-World Scenario: Intel NIC Driver Allowlisting#

Scenario: An enterprise IT team at a manufacturing plant manages a fleet of identically-configured workstations with Intel I219-LM network adapters. The security team wants to:

Allow only Intel’s WHQL-certified NIC driver (e1d68x64.sys)
Require at least version 12.18.0.0 (the minimum that patches a known CVE)
Automatically allow future Intel driver updates to the same driver
Block all other kernel drivers not explicitly approved

1
sequenceDiagram
2
    participant SecEng as Security Engineer
3
    participant PS as PowerShell (ConfigCI)
4
    participant XML as Policy XML
5
    participant Test as Test Machine
6
    participant MDM as Intune/MDM
7
    participant WS as Production Workstation (ci.dll)
8
    participant GoodDrv as e1d68x64.sys v12.19 (Intel, WHQL)
9
    participant OldDrv as e1d68x64.sys v10.0 (Intel, WHQL, CVE)
10
    participant BadDrv as malicious.sys (non-Intel attempt)
11

12
    Note over SecEng,BadDrv: Phase 1 — Driver Inventory and Policy Creation
13

14
    SecEng->>PS: Run Get-WHQLFilePublisherInfo on e1d68x64.sys
15
    PS-->>SecEng: OriginalFileName: e1d68x64.sys\nCurrent version: 12.19.3.1\nVendor CN: Intel Corporation\nWHQL: Yes
16

17
    SecEng->>SecEng: Set MinimumFileVersion = 12.18.0.0 (version that patches CVE)
18
    SecEng->>XML: Manually craft WHQLFilePublisher rule\nor use New-CIPolicy -Level WHQLFilePublisher
19
    XML-->>SecEng: Policy XML with FileAttrib (e1d68x64.sys, v12.18.0.0+)\nand Signer (Intel Corporation + WHQL EKU)
20

21
    Note over SecEng,BadDrv: Phase 2 — Test on Isolated Machine
22

23
    SecEng->>Test: Deploy policy in Audit Mode
24
    GoodDrv->>Test: Load e1d68x64.sys v12.19 (current production)
25
    Test-->>SecEng: Audit event: "would allow" — passes all 4 checks
26
    OldDrv->>Test: Load e1d68x64.sys v10.0 (old CVE version)
27
    Test-->>SecEng: Audit event: "would block" — version 10.0 < 12.18.0.0 minimum
28
    SecEng->>SecEng: Confirms policy behavior is correct
29

30
    Note over SecEng,BadDrv: Phase 3 — Production Deployment
31

32
    SecEng->>MDM: Deploy policy in Enforce Mode via OMA-URI
33
    MDM-->>WS: Policy active and enforcing
34

35
    Note over SecEng,BadDrv: Phase 4 — Normal Operation
36

37
    GoodDrv->>WS: Load e1d68x64.sys v12.19 (network adapter driver)
38
    WS->>WS: ci.dll: WHQL EKU? Yes. Intel CN? Yes. OriginalFileName=e1d68x64.sys? Yes. v12.19 >= 12.18.0.0? Yes.
39
    WS-->>GoodDrv: ALLOWED — all 4 conditions pass
40

41
    Note over SecEng,BadDrv: Phase 5 — Intel Releases Driver v12.21 (Update)
42

43
    GoodDrv->>WS: Load e1d68x64.sys v12.21 (Intel driver update)
44
    WS->>WS: ci.dll: WHQL EKU? Yes. Intel CN? Yes. OriginalFileName=e1d68x64.sys? Yes. v12.21 >= 12.18.0.0? Yes.
45
    WS-->>GoodDrv: ALLOWED — same filename, same vendor, newer version passes automatically
46
    Note over SecEng,WS: NO policy update needed for driver updates!
47

48
    Note over SecEng,BadDrv: Phase 6 — Attack Attempt (BYOVD with old vulnerable version)
49

50
    OldDrv->>WS: Attacker loads e1d68x64.sys v10.0 (known CVE, legitimate WHQL-signed)
51
    WS->>WS: ci.dll: WHQL EKU? Yes. Intel CN? Yes. OriginalFileName=e1d68x64.sys? Yes. v10.0 >= 12.18.0.0? NO.
52
    WS-->>OldDrv: BLOCKED — version floor check fails
53
    WS->>WS: Event ID 3077 logged
54

55
    Note over SecEng,BadDrv: Phase 7 — Malicious Driver Attempt
56

57
    BadDrv->>WS: Attacker tries to load custom malicious kernel driver
58
    WS->>WS: ci.dll: WHQL EKU? No (not WHQL-certified). All WHQL checks skip. No Hash rule. No other rules.
59
    WS-->>BadDrv: BLOCKED — no matching rules, default deny applies

15. Policy Maintenance: Driver Updates#

One of the most operationally important properties of WHQLFilePublisher is how it handles driver updates.

Automatic Pass: Same Filename, Same Vendor, Higher Version#

When a hardware vendor releases an updated driver:

Same OriginalFileName (e.g., e1d68x64.sys) — FileName check passes
Same vendor CN (e.g., Intel Corporation) — CN check passes
Same or newer WHQL certification — EKU check passes
New version (e.g., 12.21.0.0 > 12.18.0.0 minimum) — Version check passes

No policy update needed. The existing WHQLFilePublisher rule automatically covers the new version.

Manual Update Required: Driver Filename Changes#

If Intel releases a new NIC driver with a different OriginalFileName:

Old: e1d68x64.sys → New: e1d69x64.sys
The new filename does not match the existing FileAttrib
The new driver is blocked until a new FileAttrib is added

Action required: Add a new <FileAttrib> element for the new filename and reference it in the Intel Signer’s <FileAttribRef> list.

Handling Version Rollouts#

1
gantt
2
    title WHQLFilePublisher Version Floor Maintenance
3
    dateFormat YYYY-MM-DD
4
    section Driver Versions Released
5
    v12.18.0.0 (Initial approved min)  : milestone, 2025-01-01, 0d
6
    v12.19.0.0 (Update — auto-passes)  : milestone, 2025-03-15, 0d
7
    v12.20.0.0 (CVE discovered in v12.19) : milestone, 2025-06-01, 0d
8
    v12.21.0.0 (Patched version)        : milestone, 2025-07-01, 0d
9
    section Policy MinimumFileVersion
10
    Min: 12.18.0.0 (original floor)    : 2025-01-01, 2025-07-15
11
    Min: 12.21.0.0 (raise floor after CVE) : 2025-07-15, 2026-01-01

When a CVE is discovered in a driver version that previously passed (e.g., v12.19.0.0), raise the MinimumFileVersion in the <FileAttrib> element to the patched version (v12.21.0.0). This automatically blocks the vulnerable v12.19 without needing a separate deny rule.

16. OS Version & Compatibility#

OS Version	WHQLFilePublisher Support	Notes
Windows 10 1507+	Full support	Kernel-mode driver control
Windows 10 1709+	Full support	Dual-policy (multiple simultaneous base policies)
Windows 11 21H2+	Full support	HVCI/VBS integration
Windows Server 2016+	Full support
Windows Server 2019+	Full support
Windows Server 2022+	Full support	Secured-Core Server
ARM64	Full support	WHQL covers ARM64 kernel drivers

WHQLFilePublisher has been available since the initial WDAC release in Windows 10. The -SpecificFileNameLevel parameter for New-CIPolicy was added in later PowerShell module versions — verify your ConfigCI module version if this parameter is not available.

17. Common Mistakes & Gotchas#

Mistake 1: OriginalFileName vs. File-on-Disk Name#

Wrong assumption: “The OriginalFileName in the FileAttrib should match what the file is called on disk.”

Reality: OriginalFileName is the value compiled into the PE VERSIONINFO resource block. It is often the same as the filename on disk, but not always. A file renamed on disk still has its compiled-in OriginalFileName. Always use PowerShell’s [System.Diagnostics.FileVersionInfo]::GetVersionInfo($path).OriginalFilename to get the correct value, not just $file.Name.

Mistake 2: Version Format Errors#

WDAC MinimumFileVersion uses a four-part version: Major.Minor.Build.Revision. Common mistakes:

Incorrect Format	Correct Format	Issue
`12.18`	`12.18.0.0`	Missing build/revision parts
`12.18.9`	`12.18.9.0`	Missing revision
`v12.18.0.0`	`12.18.0.0`	Leading ‘v’ character
`12,18,0,0`	`12.18.0.0`	Commas instead of dots

An incorrectly formatted version string will cause the policy to fail to compile or produce unexpected version comparison behavior.

Mistake 3: Missing FileAttribRef in Signer#

The <FileAttrib> element defines the filename/version constraint, but it must be referenced from a Signer via <FileAttribRef RuleID="...">. A <FileAttrib> without a corresponding <FileAttribRef> in any Signer has no effect. The file will not be matched by the WHQLFilePublisher rule even if all other conditions are met.

Mistake 4: One Signer per Vendor (Not per File)#

A single <Signer> can reference multiple <FileAttrib> elements via multiple <FileAttribRef> child elements. Many policy authors mistakenly create one <Signer> per driver file, resulting in duplicate <Signer> elements with the same <CertRoot>, <CertEKU>, and <CertPublisher> values but different <FileAttribRef>. This is valid but unnecessarily verbose. Combine all files from the same vendor under a single Signer:

1
<Signer ID="ID_SIGNER_INTEL_NIC"> ... <FileAttribRef RuleID="ID_FA_NIC" /> </Signer>
2
<Signer ID="ID_SIGNER_INTEL_DIAG"> ... <FileAttribRef RuleID="ID_FA_DIAG" /> </Signer>
3

4
<Signer ID="ID_SIGNER_INTEL">
5
  <CertRoot ... />
6
  <CertEKU ... />
7
  <CertPublisher Value="Intel Corporation" />
8
  <FileAttribRef RuleID="ID_FA_NIC" />
9
  <FileAttribRef RuleID="ID_FA_DIAG" />
10
</Signer>

Mistake 5: Forgetting Deny Rules Take Precedence#

Even a perfectly constructed WHQLFilePublisher rule is overridden by a deny rule. If you merge with Microsoft’s block rules (which you should), verify that none of your approved drivers are on the deny list. If they are, you must:

Update the driver to a newer (non-blocked) version
Or exclude that specific hash from the deny list (not recommended — the denial exists for security reasons)

Mistake 6: Not Testing in Audit Mode First#

WHQLFilePublisher policies with minimum version floors can block drivers that are present on systems that haven’t been updated. Always deploy in Audit Mode first, review Event 3076 (WDAC block audit) logs from the Code Integrity event log, confirm no unexpected blocks before switching to Enforce Mode.

18. Summary Table#

Property	Value
Level Name	WHQLFilePublisher
Trust Mechanism	WHQL EKU + Vendor leaf CN + OriginalFileName + MinimumFileVersion
Conditions Required	All four must simultaneously be true
Specificity	Most specific of all WHQL-family levels
More Specific Than	WHQLPublisher, WHQL, PcaCertificate
Less Specific Than	Hash (Hash is exact-file pinning)
Primary Use Case	Production kernel driver allowlisting with version control
BYOVD Protection	Strong — version floor blocks old vulnerable certified drivers
Maintenance on Update	Zero if same filename + vendor + higher version
Maintenance on Rename	Manual — new FileAttrib element needed
XML Elements Required	`<EKU>`, `<FileAttrib>`, `<Signer>` with `<CertEKU>`, `<CertPublisher>`, `<FileAttribRef>`
OriginalFileName Source	PE VERSIONINFO resource (compiled-in, not disk filename)
MinimumFileVersion Format	`Major.Minor.Build.Revision` (four-part, no ‘v’ prefix)
PowerShell Level Name	`WHQLFilePublisher`
-SpecificFileNameLevel	Optional — changes which VERSIONINFO attribute is matched
Signing Scenario	Kernel mode (131) primary, user mode (12) rare
Kernel Component	ci.dll (Code Integrity), enforced by hypervisor under HVCI
OS Support	Windows 10 1507+ / Server 2016+
Best Paired With	Option 02 (`Required:WHQL`) + Microsoft vulnerable driver block rules
Recommended For	All production WDAC deployments that need kernel driver control