All Detections

G13 driver IOCTL 0x2220C8 cross-process memory copy via MmCopyVirtualMemory

avatar
Duo Tech@duotech
updated Aug 4, 2026005

Detects cross-process memory copy activity via IOCTL code 0x2220C8 or the MmCopyVirtualMemory kernel routine, associated with the Phantom Mantis G13 EDR-killer driver.

Microsoft Sentinel (KQL)