Query: Sigma rule for Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe o
Matching passage: Sigma rule: Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe o. Logsource: windows / process_creation. Rule: title: Windows AMSI Related Registry Tampering Via CommandLine id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 related: - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 type: similar status: experimental description: 'Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell. AMSI provides a generic interface for applications and services to integrate with antimalware products. Adversaries may disable AMSI to evade detection of malicious scripts and code execution. ' references: - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_key: CommandLine|contains|all: - \Software\Microsoft\Windows Script\Settings - AmsiEnable selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains: add selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd: CommandLine|contains: - Set-ItemProperty - New-ItemProperty - 'sp ' condition: selection_key and (all of selection_powershell_* or all of selection_reg_*) falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
Near-miss passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / process_creation. Rule: title: Potential COM Objects Download Cradles Usage - Process Creation id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf related: - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: '[Type]::GetTypeFromCLSID(' selection_2: CommandLine|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium