Yep! For example, Sysmon is registered at 385201, which is one of the ways that Shhmon locates it in case the default name has changed. While these altitudes are registered with MSFT, they aren't enforced. The mini filter can be moved to a different altitude that isn't taken.