G13 kernel driver-load blocking via G11.sys unsigned filtering driver
Detects a burst of blocked kernel driver-load events on a single host caused specifically by the G11.sys unsigned filtering driver, preventing security agent (re)initialization.
Microsoft Sentinel (KQL)
