Suspicious Process Opening Kernel Device Handle for IOCTL Kernel Memory Access
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
CQL
