Well I think the purpose for it was to detect one of the things that some worms do; write to the system32 directory. However, I found that MARS will also log this when certain services are enabled on the Windows Server you're logging due to other frequent changes in the system32 directory. I don't remember what services were causing it, but I remember creating a drop rule for the events on those specific servers because the event occurred often and was indeed a false positive. If you could post the exact content of the windows event it might help refresh my memory.
