These low-level tools often trigger "false positives" because they interact directly with hardware drivers.