G13 kernel driver XOR-obfuscated log file creation (WindowsData*.log)
Detects creation, modification, or renaming of WindowsData*.log files by an unsigned or non-Microsoft-signed process running from System32, consistent with the G13 kernel driver writing XOR-obfuscated log output.
Microsoft Sentinel (KQL)
