Phantom Mantis G13 driver creates WindowsData*.log under KnownDllPath directory by unsigned process
Detects creation of WindowsData*.log files directly under the KnownDllPath directory (C:\Windows\System32) by an unsigned process, consistent with Phantom Mantis G13 kernel-assisted EDR killer driver activity.
Microsoft Sentinel (KQL)
