Removal Of AMSI Provider Registry Keys

Status: test
Severity: high
Log source: category registry_delete, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule body

title: Removal Of AMSI Provider Registry Keys
id: 41d1058a-aea7-4952-9293-29eaaf516465
status: test
description: Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
    - https://seclists.org/fulldisclosure/2020/Mar/45
author: frack113
date: 2021-06-07
modified: 2025-10-07
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_delete
detection:
    selection:
        TargetObject|endswith:
            - '{2781761E-28E0-4109-99FE-B9D127C57AFE}' # IOfficeAntiVirus
            - '{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}' # ProtectionManagement.dll
    filter_main_defender:
        Image|startswith:
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\Program Files (x86)\Windows Defender\'
        Image|endswith: '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/info.yml
simulation:
    - type: atomic-red-team
      name: AMSI Bypass - Remove AMSI Provider Reg Key
      technique: T1562.001
      atomic_guid: 13f09b91-c953-438e-845b-b585e51cac9b

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetObject|endswith:
        - '{2781761E-28E0-4109-99FE-B9D127C57AFE}'
        - '{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}'

Stage 2: `not filter_main_defender`

filter_main_defender:
    Image|startswith:
        - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        - 'C:\Program Files\Windows Defender\'
        - 'C:\Program Files (x86)\Windows Defender\'
    Image|endswith: '\MsMpEng.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Program Files (x86)\Windows Defender\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Windows Defender\"`
`Image`	starts_with	`C:\Program Files\Windows Defender\`	`excludes:Image` `field:"Image" value:"C:\Program Files\Windows Defender\"`
`Image`	starts_with	`C:\ProgramData\Microsoft\Windows Defender\Platform\`	`excludes:Image` `field:"Image" value:"C:\ProgramData\Microsoft\Windows Defender\Platform\"`
`Image`	ends_with	`\MsMpEng.exe`	`excludes:Image` `field:"Image" value:"\MsMpEng.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`{2781761E-28E0-4109-99FE-B9D127C57AFE}` `{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}`	`field:"TargetObject" kind:ends_with`