Potential Direct Syscall of NtOpenProcess (3f3f3506-1895-401b-9cc3-e86b16e630d0)
Detects potential calls to NtOpenProcess directly from NTDLL.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) | Attack Pattern | Potential Direct Syscall of NtOpenProcess (3f3f3506-1895-401b-9cc3-e86b16e630d0) | Sigma-Rules | 1 |