Kernel device object named with 8-hex ROR32 hash under \Device\ or \DosDevices\ from unsigned/unusual driver

Duo Tech@duotech

•updated Aug 4, 2026•0•0•0

Detects creation/access of a kernel device object or symbolic link whose name is an 8-character hex hash under \Device\ or \DosDevices\, consistent with G12drv.sys date-seeded device naming.