G13 driver minifilter enumeration/unregister via IOCTL 0x222094/0x222098 (unsigned/non-system, AV/EDR altitude)

Duo Tech@duotech

•updated Aug 4, 2026•0•0•1

Detects G13 kernel driver IOCTL calls used to enumerate and unregister security-vendor minifilter drivers, restricted to unsigned callers targeting known AV/EDR minifilter altitude ranges.