Query: Sigma rule for Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) p
Matching passage: Sigma rule: Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) p. Logsource: windows / registry_set. Rule: title: Potential Persistence Via New AMSI Providers - Registry id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705 status: test description: 'Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection. ' references: - https://persistence-info.github.io/Data/amsi.html - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2025-10-26 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\AMSI\Providers\ - \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1} filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1} filter_optional_avira: Image: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe TargetObject|contains: \{00000001-3DCC-4B48-A82E-E2071FE58E05} condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate security products adding their own AMSI providers. Filter these according to your environment. level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml
Near-miss passage: Sigma rule: Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode. Logsource: windows / process_creation. Rule: title: Attempts of Kerberos Coercion Via DNS SPN Spoofing id: 0ed99dda-6a35-11ef-8c99-0242ac120002 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar status: experimental description: 'Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high