Query: detect Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used in logs
Matching passage: Sigma rule: Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used. Logsource: windows / registry_delete. Rule: title: Removal Of AMSI Provider Registry Keys id: 41d1058a-aea7-4952-9293-29eaaf516465 status: test description: Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://seclists.org/fulldisclosure/2020/Mar/45 author: frack113 date: 2021-06-07 modified: 2025-10-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: - '{2781761E-28E0-4109-99FE-B9D127C57AFE}' - '{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}' filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Remove AMSI Provider Reg Key technique: T1562.001 atomic_guid: 13f09b91-c953-438e-845b-b585e51cac9b
Near-miss passage: Sigma rule: Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Detector Deleted Or Updated id: d2656e78-c069-4571-8220-9e0ab5913f19 status: experimental description: 'Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate. ' references: - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/ - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/ - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/ - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion author: suktech24 date: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_event_source: eventSource: guardduty.amazonaws.com selection_action_delete: eventName: DeleteDetector selection_action_update: eventName: UpdateDetector requestParameters.enable: 'false' selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_* falsepositives: - Legitimate detector deletion by an admin (e.g., during account decommissioning). - Temporary disablement for troubleshooting (verify via change management tickets). - Automated deployment tools (e.g. Terraform) managing GuardDuty state. level: high