Possible Direct Syscall of NtOpenProcess (via process_access)

title: Possible Direct Syscall of NtOpenProcess (via process_access)
id: a890e3ee-42c1-58f0-8825-3dbbec8ccd84
status: stable
description: This rule detects potential calls to NtOpenProcess directly from NTDLL.
references:
    - https://attack.mitre.org/techniques/T1106/
    - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6
author: Huntrule Team
date: 2026-06-07
tags:
    - attack.execution
    - attack.t1106
logsource:
    category: process_access
    product: windows
detection:
    selection:
        CallTrace|startswith: 'UNKNOWN'
    filter_main_vcredist:
        TargetImage|endswith: 'vcredist_x64.exe'
        SourceImage|endswith: 'vcredist_x64.exe'
    filter_main_generic:
        SourceImage|contains:
            - ':\Program Files (x86)\'
            - ':\Program Files\'
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
            - ':\Windows\WinSxS\'
        TargetImage|contains:
            - ':\Program Files (x86)\'
            - ':\Program Files\'
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
            - ':\Windows\WinSxS\'
    filter_main_kerneltrace_edge:
        Provider_Name: 'Microsoft-Windows-Kernel-Audit-API-Calls'
    filter_optional_vmware:
        TargetImage|endswith: ':\Windows\system32\systeminfo.exe'
        SourceImage|endswith: 'setup64.exe'
    filter_optional_cylance:
        SourceImage|endswith: ':\Windows\Explorer.EXE'
        TargetImage|endswith: ':\Program Files\Cylance\Desktop\CylanceUI.exe'
    filter_optional_amazon:
        SourceImage|endswith: 'AmazonSSMAgentSetup.exe'
        TargetImage|endswith: 'AmazonSSMAgentSetup.exe'
    filter_optional_vscode:
        SourceImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
        TargetImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
    filter_optional_teams:
        TargetImage|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
        SourceImage|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
    filter_optional_discord:
        TargetImage|contains: '\AppData\Local\Discord\'
        TargetImage|endswith: '\Discord.exe'
    filter_optional_yammer:
        SourceImage|contains: '\AppData\Local\yammerdesktop\app-'
        SourceImage|endswith: '\Yammer.exe'
        TargetImage|contains: '\AppData\Local\yammerdesktop\app-'
        TargetImage|endswith: '\Yammer.exe'
        GrantedAccess: '0x1000'
    filter_optional_evernote:
        TargetImage|endswith: '\Evernote\Evernote.exe'
    filter_optional_adobe_acrobat:
        SourceImage|contains: ':\Program Files\Adobe\Acrobat DC\Acrobat\'
        SourceImage|endswith: '\AcroCEF.exe'
        TargetImage|contains: ':\Program Files\Adobe\Acrobat DC\Acrobat\'
        TargetImage|endswith: '\AcroCEF.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium