Process creation via direct syscall

Identifies process creation initiated via direct system call, a technique commonly used by malware to bypass user-mode API hooks and evade security monitoring.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules