Option 2 — Required (Windows Hardware Quality Labs Certification)#

flowchart TD
    classDef secure fill:#0d1f12,color:#86efac,stroke:#166534
    classDef weak fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
    classDef neutral fill:#162032,color:#58a6ff,stroke:#1e3a5f

    subgraph WHQL_Certified["WHQL Certified Driver"]
        direction TB
        A1([Submitted to WHDC portal]):::secure
        A2([Tested against HLK suite]):::secure
        A3([Microsoft reviews submission]):::secure
        A4([Signed with Microsoft WHQL\ncertificate chain]):::secure
        A5([Listed in Windows Update catalog]):::secure
        A1 --> A2 --> A3 --> A4 --> A5
    end

    subgraph Legacy_Cross["Legacy Cross-Signed Driver"])"]
        direction TB
        B1([Vendor self-signs]):::weak
        B2([No HLK testing required]):::weak
        B3([No Microsoft review]):::weak
        B4([Signed by third-party CA\nunder cross-sign program]):::weak
        B5([Not in WHDC catalog]):::weak
        B1 --> B2 --> B3 --> B4 --> B5
    end

flowchart LR
    classDef kernel fill:#162032,color:#58a6ff,stroke:#1e3a5f
    classDef allow fill:#0d1f12,color:#86efac,stroke:#166534
    classDef block fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
    classDef option fill:#1a1a0d,color:#fde68a,stroke:#713f12

    MSRoot([Microsoft Root CA]) --> WHQL_CA([Microsoft WHQL\nCode Signing CA]):::allow
    MSRoot --> CrossSign_CA([Third-Party CA\nCross-Sign])

    WHQL_CA --> WHQL_Driver([WHQL Certified Driver\nAllowed by Option 2]):::allow
    CrossSign_CA --> Legacy_Driver([Legacy Cross-Signed Driver\nBLOCKED by Option 2]):::block
    CrossSign_CA --> Stolen_Cert([Stolen/Abused Cert\nBLOCKED by Option 2]):::block

    Unsigned([Unsigned Driver\nBLOCKED by any WDAC]):::block

    WHQL_Driver --> Kernel([Kernel]):::kernel
    Legacy_Driver -.->|"Blocked at CI gate"| Kernel
    Stolen_Cert -.->|"Blocked at CI gate"| Kernel
    Unsigned -.->|"Blocked at CI gate"| Kernel

flowchart TD
    classDef kernel fill:#162032,color:#58a6ff,stroke:#1e3a5f
    classDef usermode fill:#0d1f12,color:#86efac,stroke:#166534
    classDef option fill:#1a1a0d,color:#fde68a,stroke:#713f12

    A([Binary or Driver Execution]) --> B{Kernel-mode?}
    B -- Yes --> C["Option 2: Required:WHQL\nKernel enforcement layer"]:::option
    C --> D{WHQL cert?}
    D -- Yes --> E([Kernel driver loads]):::kernel
    D -- No --> F([Kernel driver blocked]):::kernel

    B -- No --> G["Option 0: Enabled:UMCI\nUser-mode enforcement layer"]:::option
    G --> H{Policy allow rule?}
    H -- Yes --> I([User binary executes]):::usermode
    H -- No --> J([User binary blocked]):::usermode

sequenceDiagram
    autonumber
    actor Attacker
    participant Malware as Malware Process
    participant SCM as Service Control Manager
    participant KernelCI as Kernel Code Integrity
    participant PolicyEng as WDAC Policy Engine
    participant EventLog as Windows Event Log
    participant EDR as EDR Process

    Note over Attacker,EDR: WITHOUT Required:WHQL (Default)
    Attacker ->> Malware: Execute attack tool with embedded RTCore64.sys
    Malware ->> SCM: sc.exe create RTCore64 binPath=RTCore64.sys type=kernel
    SCM ->> KernelCI: Request driver load
    KernelCI ->> PolicyEng: Check RTCore64.sys signature
    PolicyEng -->> KernelCI: Cross-signed by DigiCert — ALLOWED (no WHQL req)
    KernelCI -->> SCM: Driver approved
    SCM -->> Malware: Driver loaded
    Malware ->> EDR: Kill EDR via kernel IOCTL
    EDR -->> Attacker: EDR terminated — attack continues undetected

    Note over Attacker,EDR: WITH Required:WHQL (Option 2 Enabled)
    Attacker ->> Malware: Execute attack tool with embedded RTCore64.sys
    Malware ->> SCM: sc.exe create RTCore64 binPath=RTCore64.sys type=kernel
    SCM ->> KernelCI: Request driver load
    KernelCI ->> PolicyEng: Check RTCore64.sys signature
    PolicyEng -->> KernelCI: Cross-signed only — WHQL cert MISSING — BLOCK
    KernelCI -->> SCM: STATUS_ACCESS_DENIED
    SCM -->> Malware: Driver load failed
    KernelCI ->> EventLog: Event ID 3082 — non-WHQL driver blocked
    EventLog -->> EDR: Alert forwarded to SIEM

sequenceDiagram
    autonumber
    actor Admin
    participant PolicyXML as Policy XML
    participant TestMachines as Test Fleet (10 VMs)
    participant AuditLog as CodeIntegrity Event Log
    participant DriverStore as Windows Driver Store
    participant ProdFleet as Production Fleet (1000 Endpoints)

    Admin ->> PolicyXML: Set Option 2 + Option 3 (WHQL + Audit)
    Admin ->> PolicyXML: ConvertFrom-CIPolicy → audit_whql.cip
    Admin ->> TestMachines: Deploy audit_whql.cip via Intune test ring
    TestMachines ->> AuditLog: Generate Event 3082 for non-WHQL drivers
    Admin ->> AuditLog: Collect and analyze 3082 events
    AuditLog -->> Admin: List of 3 non-WHQL drivers found
    Admin ->> DriverStore: Check Windows Update catalog for WHQL versions
    DriverStore -->> Admin: 2 of 3 have WHQL updates available
    Admin ->> PolicyXML: Update driver inventory; update hardware for 1 exception
    Admin ->> PolicyXML: Remove Option 3 (Audit) — keep Option 2 (WHQL)
    Admin ->> PolicyXML: ConvertFrom-CIPolicy → enforced_whql.cip
    Admin ->> ProdFleet: Staged rollout: 100 → 500 → 1000 endpoints
    ProdFleet -->> Admin: Zero driver blocks reported — rollout successful

flowchart TD
    classDef block fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
    classDef warn fill:#1a1a0d,color:#fde68a,stroke:#713f12

    A([Enable WHQL without audit]) --> B[Legacy printer driver blocked]:::block
    A --> C[Legacy NIC driver blocked]:::block
    A --> D[Third-party security tool driver blocked]:::block
    B --> E([Printing disabled across fleet]):::block
    C --> F([Network connectivity lost on some endpoints]):::block
    D --> G([EDR/AV kernel component non-functional]):::block
    E --> H([Helpdesk overwhelmed]):::warn
    F --> H
    G --> H
    H --> I([Emergency policy rollback required]):::warn