VirIT driver kernel process termination with exit status 99 (DriverKiller abuse)
Detects process termination with exit code 99 consistent with the VirIT Agent driver abused by DriverKiller, tightly correlated with presence of the DriverKiller service / Viragtlt device on the host.
Microsoft Sentinel (KQL)
