Uncommon Process Access Rights For Target Image
This rule detects attempts to gain 'PROCESS_ALL_ACCESS' rights to specific, commonly used Windows processes such as 'calc.exe', 'notepad.exe', and 'mspaint.exe'. Granting 'PROCESS_ALL_ACCESS' provides the requesting process with all possible access rights to the target process, which can be abused by malicious software for process injection, privilege escalation, or defense evasion.
Sigma
