Process creation via direct syscall

Identifies process creation initiated via direct system call, a technique commonly used by malware to bypass user-mode API hooks and evade security monitoring.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas