[Rule Tuning] Suspicious Process Access via Direct System Call

[lowlevel01]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml

Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

Description

Hi,

I have a question. I noticed this rule uses the wildcard "*" in the excluded paths. I wonder if this is safe? Do we assume if the user has admin rights then they can use direct syscalls?

Example Data

No response