Reynolds Ransomware NSecKrnl IOCTL 0x2248E0 Kill Command via DeviceIoControl

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•4

This rule detects potential rootkit activity by monitoring for specific DeviceIoControl requests (code 2248E0), the presence of a suspicious file (402.sys) in the ProgramData directory, and specific NamedPipe events (NSecKrnl). These indicators are often associated with kernel-level malicious implants or rootkits attempting to hide their presence or interact with the system at a low level.