PoisonX (g11.sys) Kernel Driver Load Followed by Security Process Termination
Detects the creation or modification of a file named 'g11.sys'. This filename is often associated with the deployment of malicious or vulnerable drivers used for kernel-mode exploitation, such as Bring Your Own Vulnerable Driver (BYOVD) attacks or rootkit activity.
Cortex XDR
