Merge pull request #3785 from veramine/patch-4

Add System to list of built-in Windows processes with no extension

rules/windows/process_creation/proc_creation_win_susp_image_missing.yml

@@ -6,7 +6,7 @@ references:
     - https://pentestlaboratories.com/2021/12/08/process-ghosting/
 author: Max Altgelt
 date: 2021/12/09
-modified: 2022/09/20
+modified: 2022/12/14
 tags:
     - attack.defense_evasion
 logsource:
@@ -23,6 +23,7 @@ detection:
             - ''
     filter_4688:
         - Image:
+            - 'System'
             - 'Registry'
             - 'MemCompression'
             - 'vmmem'