Raw system calls are direct requests from a program to the Linux kernel, made without using higher-level libraries such as libc wrappers. Instead of calling a friendly API like open() or read(), the code invokes the kernel interface more directly. This gives the caller finer control over how an action is performed and can reduce reliance on user-space abstractions.
In cyber security, raw system calls matter because they can change how activity looks to defenders. Attack tools may use them to avoid hooks, sensors, or behavior checks placed in common library functions, or to blend with lower-level kernel-facing activity. Defenders also need to understand them because many monitoring products and sandbox techniques watch for syscall patterns to spot malware or unusual system access. Seeing direct syscall use is not proof of malicious intent, but it can be a useful signal when combined with other suspicious behavior.