CSA - Access system functions?

Question

Can anyone else post any examples of times they needed to make an exception for allowing a certain application to access system functions? I keep getting several trips of the rule for accessing system functions, and I'm sure there is no attack or spyware on the machine. The only event I can manually replicate is when Windows Media Player tries to access license files online ("CreateThread").
Just curious to see if anyone else has had to build an exception or allow rule for accessing system functions.

Answer 1

it might help to explain the context of why I'm trying to do this too, so here goes all...
I've seen several event logs where Rule 886 was tripped. Rule 886 is a System API rule in the General Application Permissions - all security levels rule module. The details of the rule are that it queries the user whenever a Network Application, MS explorer, rundll32.exe, or any media application, tries to "access system functions from code executing in data or stack space", which is listed under Atypical system behavior.
Most of these events occur late at night, and appear to be something dealing with updates or spyware scans. I haven't yet been able to isolate or replicate those. The only time I've been able to manually trip this rule is when Windows Media Player attempts to download license files for a CD/song, it will access "CreateThread" system function.
Now, the reason I'm worried about this is that end users are going to throw up their hands at the query, which says "Application xxxxx.exe is attempting to access System Function zzzzz. Would you like to allow this?". They're going to either have no idea what to do and call the Helpdesk or they're going to take a guess at what to do and could cause something bad.