G13 driver IOCTL 0x221E64 destructive memory wipe targeting distinct security process
Detects invocation of the G13 killer driver's WipeProcessUserMemory routine via IOCTL 0x221E64, requiring the wipe target be a distinct, identified process from the process that issued the IOCTL.
Microsoft Sentinel (KQL)
