{"id":"7dbbcac2-57a0-45ac-b306-ff30a8bd2981","title":"Windows AMSI Related Registry Tampering Via CommandLine","description":"Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.\nAMSI provides a generic interface for applications and services to integrate with antimalware products.\nAdversaries may disable AMSI to evade detection of malicious scripts and code execution.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-12-25","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md","https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d","https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/"],"source_path":"rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml","source_sha256":"8d4365ec898b73410a31b06d24f6395dabf916d723f09ae5442c47e9c7b4ec98","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows AMSI Related Registry Tampering Via CommandLine\nid: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981\nrelated:\n    - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 # AMSI Disabled via Registry Modification\n      type: similar\nstatus: experimental\ndescription: |\n    Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.\n    AMSI provides a generic interface for applications and services to integrate with antimalware products.\n    Adversaries may disable AMSI to evade detection of malicious scripts and code execution.\nreferences:\n    - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md\n    - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d\n    - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-12-25\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_key:\n        CommandLine|contains|all:\n            - '\\Software\\Microsoft\\Windows Script\\Settings'\n            - 'AmsiEnable'\n    selection_reg_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_reg_cmd:\n        CommandLine|contains: 'add'\n    selection_powershell_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_powershell_cmd:\n        CommandLine|contains:\n            - 'Set-ItemProperty'\n            - 'New-ItemProperty'\n            - 'sp '\n    condition: selection_key and (all of selection_powershell_* or all of selection_reg_*)\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: AMSI Bypass - Create AMSIEnable Reg Key\n      technique: T1562.001\n      atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/7dbbcac2-57a0-45ac-b306-ff30a8bd2981.json","kind":"sigma"}