title: Direct Syscall of NtOpenProcess
id: 3f3f3506-1895-401b-9cc3-e86b16e630d0 
description: Detects the usage of the direct syscall of NtOpenProcess which might be done from a CobaltStrike BOF.
references:
    - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6
status: experimental
author: Christian Burkard
date: 2021/07/28
logsource:
    category: process_access
    product: windows
detection:
    selection:
        CallTrace|startswith: 'UNKNOWN'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.execution
    - attack.t1106 
