Sigma rule: Potential Direct Syscall of NtOpenProcess

Rule

Title

Potential Direct Syscall of NtOpenProcess

Status

test

Level

medium

Author

Christian Burkard (Nextron Systems), Tim Shelton (FP)

Date

2021-07-28

Modified

2023-12-13

File

rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential calls to NtOpenProcess directly from NTDLL.

Log source

product

windows

category

process_access

Detection

selection:
    CallTrace|startswith: 'UNKNOWN'
filter_main_vcredist:
    TargetImage|endswith: 'vcredist_x64.exe'
    SourceImage|endswith: 'vcredist_x64.exe'
filter_main_generic:
    # Examples include "systeminfo", "backgroundTaskHost", "AUDIODG"
    SourceImage|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
        - ':\Windows\WinSxS\'
    TargetImage|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
        - ':\Windows\WinSxS\'
filter_main_kerneltrace_edge:
    # Cases in which the CallTrace is just e.g. 'UNKNOWN(19290435374)' from Microsoft-Windows-Kernel-Audit-API-Calls provider
    Provider_Name: 'Microsoft-Windows-Kernel-Audit-API-Calls'
filter_optional_vmware:
    TargetImage|endswith: ':\Windows\system32\systeminfo.exe'
    SourceImage|endswith: 'setup64.exe' # vmware
filter_optional_cylance:
    SourceImage|endswith: ':\Windows\Explorer.EXE'
    TargetImage|endswith: ':\Program Files\Cylance\Desktop\CylanceUI.exe'
filter_optional_amazon:
    SourceImage|endswith: 'AmazonSSMAgentSetup.exe'
    TargetImage|endswith: 'AmazonSSMAgentSetup.exe'
filter_optional_vscode: # VsCode
    SourceImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
    TargetImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
filter_optional_teams: # MS Teams
    TargetImage|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
    SourceImage|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
filter_optional_discord: # Discord
    TargetImage|contains: '\AppData\Local\Discord\'
    TargetImage|endswith: '\Discord.exe'
filter_optional_yammer:
    SourceImage|contains: '\AppData\Local\yammerdesktop\app-'
    SourceImage|endswith: '\Yammer.exe'
    TargetImage|contains: '\AppData\Local\yammerdesktop\app-'
    TargetImage|endswith: '\Yammer.exe'
    GrantedAccess: '0x1000'
filter_optional_evernote:
    TargetImage|endswith: '\Evernote\Evernote.exe'
filter_optional_adobe_acrobat:
    SourceImage|contains: ':\Program Files\Adobe\Acrobat DC\Acrobat\'
    SourceImage|endswith: '\AcroCEF.exe'
    TargetImage|contains: ':\Program Files\Adobe\Acrobat DC\Acrobat\'
    TargetImage|endswith: '\AcroCEF.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1106

MITRE ATT&CK ids this rule names

• T1106

References

• https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml