Sigma rule: Amsi.DLL Load By Uncommon Process

Rule

Title

Amsi.DLL Load By Uncommon Process

Status

test

Level

low

Author

frack113

Date

2023-03-12

Modified

2026-06-29

File

rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects loading of Amsi.dll by uncommon processes

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith: '\amsi.dll'
filter_main_exact:
    Image|endswith:
        - ':\Windows\explorer.exe'
        - ':\Windows\Sysmon64.exe'
        - ':\Windows\Sysmon64a.exe'
filter_main_generic:
    Image|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
        - ':\Windows\WinSxS\'
filter_optional_defender:
    Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
filter_main_dotnet:
    Image|contains:
        - ':\Windows\Microsoft.NET\Framework\'
        - ':\Windows\Microsoft.NET\Framework64\'
        - ':\Windows\Microsoft.NET\FrameworkArm\'
        - ':\Windows\Microsoft.NET\FrameworkArm64\'
    Image|endswith: '\ngentask.exe'
filter_main_null:
    Image: null
filter_main_empty:
    Image: ''
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate third party apps installed in "ProgramData" and "AppData" might generate some false positives. Apply additional filters accordingly

Tags

• attack.impact
• attack.t1490
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1490

References

• https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
• https://github.com/TheD1rkMtr/AMSI_patch
• https://github.com/surya-dev-singh/AmsiBypass-OpenSession

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml