Kernel driver arbitrary file query/read/write/rename via killer-driver IOCTLs (unsigned, security-product paths)

Duo Tech@duotech

•updated Aug 4, 2026•0•0•2

Detects IOCTL requests to the Phantom Mantis G12/G13 killer driver used for kernel-mode arbitrary file operations (query/read/write/rename), scoped to unsigned callers targeting security-product install directories.