{
  "driverModel": "wdm",
  "relatedDDIs": [
    "EtwRegister",
    "EtwUnregister",
    "ExIsProcessorFeaturePresent",
    "ExRaiseAccessViolation",
    "ExRaiseDatatypeMisalignment",
    "ExUuidCreate",
    "FsRtlAcquireFileExclusive",
    "FsRtlAreNamesEqual",
    "FsRtlBalanceReads",
    "FsRtlCancellableWaitForMultipleObjects",
    "FsRtlChangeBackingFileObject",
    "FsRtlCopyRead",
    "FsRtlCopyWrite",
    "FsRtlDeregisterUncProvider",
    "FsRtlDissectName",
    "FsRtlDoesNameContainWildCards",
    "FsRtlGetFileSize",
    "FsRtlIsNameInExpression",
    "FsRtlMdlRead",
    "FsRtlMdlReadComplete",
    "FsRtlMdlReadCompleteDev",
    "FsRtlMdlWriteCompleteDev",
    "FsRtlNotifyFilterChangeDirectory",
    "FsRtlNotifyFilterReportChange",
    "FsRtlNotifyFullChangeDirectory",
    "FsRtlNotifyFullReportChange",
    "FsRtlRegisterUncProvider",
    "FsRtlRegisterUncProviderEx",
    "FsRtlRemoveDotsFromPath",
    "FsRtlValidateReparsePointBuffer",
    "HalExamineMBR",
    "HalGetInterruptVector",
    "IoBuildDeviceIoControlRequest",
    "IoBuildSynchronousFsdRequest",
    "IoCheckShareAccess",
    "IoConnectInterrupt",
    "IoCreateController",
    "IoCreateFile",
    "IoCreateSymbolicLink",
    "IoCreateSynchronizationEvent",
    "IoCreateUnprotectedSymbolicLink",
    "IoDeleteController",
    "IoDeleteSymbolicLink",
    "IoDetachDevice",
    "IoDisconnectInterrupt",
    "IoGetConfigurationInformation",
    "IoGetDeviceInterfaceAlias",
    "IoGetDeviceInterfaces",
    "IoGetDeviceNumaNode",
    "IoGetDeviceObjectPointer",
    "IoGetDeviceProperty",
    "IoGetDevicePropertyData",
    "IoGetDeviceToVerify",
    "IoGetDmaAdapter",
    "IoGetFileObjectGenericMapping",
    "IoInitializeTimer",
    "IoIsWdmVersionAvailable",
    "IoOpenDeviceInterfaceRegistryKey",
    "IoOpenDeviceRegistryKey",
    "IoReadPartitionTable",
    "IoReadPartitionTableEx",
    "IoRegisterBootDriverReinitialization",
    "IoRegisterDeviceInterface",
    "IoRegisterDriverReinitialization",
    "IoRegisterLastChanceShutdownNotification",
    "IoRegisterPlugPlayNotification",
    "IoRegisterShutdownNotification",
    "IoRemoveShareAccess",
    "IoReplacePartitionUnit",
    "IoReportDetectedDevice",
    "IoReportTargetDeviceChange",
    "IoSetDeviceInterfaceState",
    "IoSetDevicePropertyData",
    "IoSetPartitionInformation",
    "IoSetPartitionInformationEx",
    "IoUnregisterPlugPlayNotification",
    "IoUnregisterPlugPlayNotificationEx",
    "IoUnregisterShutdownNotification",
    "IoUpdateShareAccess",
    "IoWMIAllocateInstanceIds",
    "IoWMIRegistrationControl",
    "IoWritePartitionTable",
    "IoWritePartitionTableEx",
    "KeDelayExecutionThread",
    "KeInitializeSemaphore",
    "KeQueryPriorityThread",
    "KeQueryRuntimeThread",
    "KeRemoveQueue",
    "KeRevertToUserAffinityThreadEx",
    "KeSetSystemAffinityThread",
    "KeSetSystemGroupAffinityThread",
    "MmAddPhysicalMemory",
    "MmCreateMirror",
    "MmGetPhysicalMemoryRanges",
    "MmGetSystemRoutineAddress",
    "MmOutPageKernelStack",
    "MmPrefetchPages",
    "MmRemovePhysicalMemory",
    "PsAssignImpersonationToken",
    "PsDereferenceImpersonationToken",
    "PsDereferencePrimaryToken",
    "PsDisableImpersonation",
    "PsGetVersion",
    "PshedRegisterPlugin",
    "PsImpersonateClient",
    "PsReferencePrimaryToken",
    "PsRemoveLoadImageNotifyRoutine",
    "PsRestoreImpersonation",
    "PsRevertToSelf",
    "PsSetCreateProcessNotifyRoutine",
    "PsSetCreateProcessNotifyRoutineEx",
    "PsSetCreateThreadNotifyRoutine",
    "PsSetLoadImageNotifyRoutine",
    "PsTerminateSystemThread",
    "SeAccessCheck",
    "SeAssignSecurity",
    "SeDeassignSecurity",
    "SeSinglePrivilegeCheck",
    "SeValidSecurityDescriptor",
    "ZwAllocateLocallyUniqueId",
    "ZwAllocateVirtualMemory",
    "ZwCancelTimer",
    "ZwClose",
    "ZwCommitComplete",
    "ZwCommitEnlistment",
    "ZwCommitTransaction",
    "ZwCreateDirectoryObject",
    "ZwCreateEnlistment",
    "ZwCreateEvent",
    "ZwCreateFile",
    "ZwCreateKey",
    "ZwCreateKeyTransacted",
    "ZwCreateResourceManager",
    "ZwCreateTimer",
    "ZwCreateTransaction",
    "ZwCreateTransactionManager",
    "ZwDeleteFile",
    "ZwDeleteKey",
    "ZwDeleteValueKey",
    "ZwDeviceIoControlFile",
    "ZwDisplayString",
    "ZwDuplicateToken",
    "ZwEnumerateKey",
    "ZwEnumerateTransactionObject",
    "ZwEnumerateValueKey",
    "ZwFlushBuffersFile",
    "ZwFreeVirtualMemory",
    "ZwFsControlFile",
    "ZwGetNotificationResourceManager",
    "ZwLoadDriver",
    "ZwLockFile",
    "ZwMakeTemporaryObject",
    "ZwMapViewOfSection",
    "ZwNotifyChangeKey",
    "ZwNotifyChangeMultipleKeys",
    "ZwOpenDirectoryObject",
    "ZwOpenEnlistment",
    "ZwOpenEvent",
    "ZwOpenFile",
    "ZwOpenKey",
    "ZwOpenKeyEx",
    "ZwOpenKeyTransacted",
    "ZwOpenKeyTransactedEx",
    "ZwOpenProcess",
    "ZwOpenProcessTokenEx",
    "ZwOpenResourceManager",
    "ZwOpenSection",
    "ZwOpenSymbolicLinkObject",
    "ZwOpenThreadTokenEx",
    "ZwOpenTimer",
    "ZwOpenTransaction",
    "ZwOpenTransactionManager",
    "ZwPowerInformation",
    "ZwPrepareComplete",
    "ZwPrepareEnlistment",
    "ZwPrePrepareComplete",
    "ZwPrePrepareEnlistment",
    "ZwQueryDirectoryFile",
    "ZwQueryEaFile",
    "ZwQueryFullAttributesFile",
    "ZwQueryInformationEnlistment",
    "ZwQueryInformationFile",
    "ZwQueryInformationResourceManager",
    "ZwQueryInformationToken",
    "ZwQueryInformationTransaction",
    "ZwQueryInformationTransactionManager",
    "ZwQueryKey",
    "ZwQueryMultipleValueKey",
    "ZwQueryObject",
    "ZwQueryQuotaInformationFile",
    "ZwQuerySecurityObject",
    "ZwQuerySymbolicLinkObject",
    "ZwQueryValueKey",
    "ZwQueryVolumeInformationFile",
    "ZwReadFile",
    "ZwReadOnlyEnlistment",
    "ZwRecoverEnlistment",
    "ZwRecoverTransactionManager",
    "ZwRenameKey",
    "ZwRollbackComplete",
    "ZwRollbackEnlistment",
    "ZwRollbackTransaction",
    "ZwRollforwardTransactionManager",
    "ZwSetEaFile",
    "ZwSetInformationEnlistment",
    "ZwSetInformationFile",
    "ZwSetInformationKey",
    "ZwSetInformationThread",
    "ZwSetInformationToken",
    "ZwSetInformationTransaction",
    "ZwSetInformationTransactionManager",
    "ZwSetQuotaInformationFile",
    "ZwSetSecurityObject",
    "ZwSetTimer",
    "ZwSetTimerEx",
    "ZwSetValueKey",
    "ZwSetVolumeInformationFile",
    "ZwSinglePhaseReject",
    "ZwTerminateProcess",
    "ZwUnloadDriver",
    "ZwUnlockFile",
    "ZwUnmapViewOfSection",
    "ZwWriteFile"
  ],
  "ruleName": "PowerIrpDDis"
}