Sigma rule: Windows AMSI Related Registry Tampering Via CommandLine

Rule

Title

Windows AMSI Related Registry Tampering Via CommandLine

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-12-25

File

rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.
AMSI provides a generic interface for applications and services to integrate with antimalware products.
Adversaries may disable AMSI to evade detection of malicious scripts and code execution.

Log source

product

windows

category

process_creation

Detection

selection_key:
    CommandLine|contains|all:
        - '\Software\Microsoft\Windows Script\Settings'
        - 'AmsiEnable'
selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_reg_cmd:
    CommandLine|contains: 'add'
selection_powershell_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_powershell_cmd:
    CommandLine|contains:
        - 'Set-ItemProperty'
        - 'New-ItemProperty'
        - 'sp '
condition: selection_key and (all of selection_powershell_* or all of selection_reg_*)

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

Related rules

• aa37cbb0-da36-42cb-a90f-fdf216fc7467 (similar)

References

• https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
• https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
• https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml