Techniques
Sample rules
Potential Persistence Via New AMSI Providers - Registry
- source: sigma
- technicques:
Description
Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
Detection logic
condition: selection and not 1 of filter_optional_*
filter_optional_avast:
Image:
- C:\Program Files\Avast Software\Avast\RegSvr.exe
- C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
filter_optional_avg:
Image:
- C:\Program Files\AVG\Antivirus\RegSvr.exe
- C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
filter_optional_avira:
Image: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
TargetObject|contains: \{00000001-3DCC-4B48-A82E-E2071FE58E05}
selection:
TargetObject|contains:
- \SOFTWARE\Microsoft\AMSI\Providers\
- \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\