Sunturai
Back to results
MediumSigmaHQNasreddine Bencherchali (Nextron Systems)

Potential Persistence Via New AMSI Providers - Registry

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection…

Description

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.

Detection logic

Detection requirements

Log source product
windows
Log source category
registry_set

Known benign triggers

  • Legitimate security products adding their own AMSI providers. Filter these according to your environment.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice