Repeated STATUS_ACCESS_DENIED driver service start failures per driver (G13 entry-point patch)
Detects the observable effect of G13's driver entry-point patch capability: repeated Service Control Manager STATUS_ACCESS_DENIED failures starting the same targeted kernel driver.
Microsoft Sentinel (KQL)

