G13 kernel driver memory-destruction IOCTLs against security agent processes (0x221E64/0x2220E4)
Detects G13 kernel driver IOCTLs that destructively overwrite process memory (0xCC fill pattern) to disable security agent processes, requiring a distinct identified target process.
Microsoft Sentinel (KQL)
