Detection rules › Sigma
Removal Of AMSI Provider Registry Keys
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1562.001 Impair Defenses: Disable or Modify Tools |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 14 | RegistryEvent (Key and Value Rename) |
Stages and Predicates
Stage 1: selection
or:
TargetObject|endswith: '{2781761E-28E0-4109-99FE-B9D127C57AFE}'
TargetObject|endswith: '{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}'
Stage 2: not 1 of filter_main_defender
or:
Image|startswith: 'C:\Program Files (x86)\Windows Defender\'
Image|startswith: 'C:\Program Files\Windows Defender\'
Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
Image|endswith: '\MsMpEng.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
Image | starts_with |
|
TargetObject | ends_with |
|