IOCTL communication with msagent.sys rootkit driver from unsigned/non-standard process
Detects IOCTL communication with the msagent.sys rootkit driver's device object from an unsigned or non-standard-path process, indicating rootkit configuration/control activity.
Microsoft Sentinel (KQL)
