G13 driver-load inspection IOCTLs from unsigned/non-system processes (0x22208C/0x222090/0x2220C4)

Duo Tech@duotech

•updated Aug 4, 2026•1•0•4

Detects processes issuing driver IOCTL codes 0x22208c, 0x222090, or 0x2220c4 associated with the G13 kernel-assisted EDR killer, where the initiating process is unsigned or not signed by a trusted authority.