Unauthorized WFP filter/callout registration at redirection layers by non-system binaries (Phantom Mantis G12)
Detects driver-level WFP filter/callout registration at network-redirection-relevant layers that can be used to redirect or interfere with security-vendor network traffic (G12 capability).
Microsoft Sentinel (KQL)
