Potential Direct Syscall of NtOpenProcess

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•1•0•13

This rule detects potential direct system calls to NtOpenProcess, specifically when the CallTrace starts with 'UNKNOWN'. This behavior can be indicative of advanced persistent threats (APTs) or malware attempting to evade detection by bypassing user-mode API hooks. The rule includes several filters to reduce false positives from legitimate applications and system processes.