G13 kernel memory write primitive via IOCTL 0x22209C (unsigned, cross-process)
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Microsoft Sentinel (KQL)
