Analytics BIOC
Low
✕
A suspicious direct syscall was executed
A suspicious direct syscall was executed.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Native API (T1106)
Detector tags: Direct Syscall Analytics
Attacker's goals:
An attacker might try to use direct syscalls to evade detection from a legitimate program.
Investigative actions:
Investigate the direct syscall-mapped image to verify if it is malicious. Check if this direct syscall is part of the process execution flow.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- A suspicious direct syscall was executed by unsigned process from a user folder High (parent: Low)
- A suspicious direct syscall was executed by a DLL host application Medium (parent: Low)