System Calls
The interface user-space programs use to request services from the kernel, like reading files, opening network connections, or creating processes. Defenders inspect syscalls to characterize behavior.
Concept Neighborhood
Explore this concept’s connections in the groups below.
Start here
Sysmon
A related concept to explore, covered by 8 lessons.
SysmonStart here
8
lessons
User Space
6
lessons
SMB Lateral Movement Detection
5
lessons
Behavioral Detection
1
lesson
EDR
1
lesson
Runtime Security
1
lesson
Show 2 more connections
Related Lessons
6 lessons cover this conceptProcesses, Users, and the Idea of Security Context
General Beginner
Windows Essentials for Defenders
General Beginner
Linux Essentials for Defenders
General Beginner
Privilege Escalation on Both Platforms
General Beginner
Persistence: Long-Term Attacker Footholds
General Beginner
Reading Endpoint Evidence Like a Defender
General Beginner
Sign in to open lesson content directly.