Sigma rule: Potential Persistence Via New AMSI Providers - Registry

Rule

Title

Potential Persistence Via New AMSI Providers - Registry

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-21

Modified

2025-10-26

File

rules/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections.
Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\SOFTWARE\Microsoft\AMSI\Providers\'
        - '\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\'
filter_optional_avast:
    Image:
        - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
        - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
    TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avg:
    Image:
        - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
        - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
    TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avira:
    Image: 'C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe'
    TargetObject|contains: '\{00000001-3DCC-4B48-A82E-E2071FE58E05}'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate security products adding their own AMSI providers. Filter these according to your environment.

Tags

• attack.persistence

References

• https://persistence-info.github.io/Data/amsi.html
• https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml