Kernel driver IOCTL-based process termination via 0x22201C/0x221E60
This rule detects suspicious communication between user-mode processes and kernel-mode drivers using specific Input/Output Control (IOCTL) codes. These IOCTL codes are often associated with known vulnerable drivers that can be exploited for privilege escalation (BYOVD - Bring Your Own Vulnerable Driver) or unauthorized kernel interactions.
Microsoft Sentinel (KQL)
