Kernel driver image-path spoofing via IOCTL 0x222418 (FILE_OBJECT filename overwrite)

Duo Tech@duotech

•updated Aug 4, 2026•0•0•3

Detects a user-mode process sending IOCTL 0x222418 to a kernel driver to overwrite the file-name buffer in a process's image FILE_OBJECT, spoofing the reported process image path.