G13 multi-artifact staged file drop from common unsigned process

Duo Tech@duotech

•updated Aug 4, 2026•0•0•2

Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.