detection.wiki

Detection rules › Sigma

Potential Persistence Via New AMSI Providers - Registry

Status
test
Severity
medium
Log source
product windows, category registry_set
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Potential Persistence Via New AMSI Providers - Registry
id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705
status: test
description: |
    Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections.
    Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
    This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
references:
    - https://persistence-info.github.io/Data/amsi.html
    - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2025-10-26
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\SOFTWARE\Microsoft\AMSI\Providers\'
            - '\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
            - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
        TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
    filter_optional_avg:
        Image:
            - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
            - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
        TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
    filter_optional_avira:
        Image: 'C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe'
        TargetObject|contains: '\{00000001-3DCC-4B48-A82E-E2071FE58E05}'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate security products adding their own AMSI providers. Filter these according to your environment.
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_optional_*

Stage 1: selection

selection:
    TargetObject|contains:
        - '\SOFTWARE\Microsoft\AMSI\Providers\'
        - '\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\'

Stage 2: not filter_optional_*

filter_optional_avast:
    Image:
        - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
        - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
    TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avg:
    Image:
        - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
        - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
    TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avira:
    Image: 'C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe'
    TargetObject|contains: '\{00000001-3DCC-4B48-A82E-E2071FE58E05}'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
ImageeqC:\Program Files\AVG\Antivirus\RegSvr.exe
ImageeqC:\Program Files\AVG\Antivirus\x86\RegSvr.exe
TargetObjectmatch\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
ImageeqC:\Program Files\Avast Software\Avast\RegSvr.exe
ImageeqC:\Program Files\Avast Software\Avast\x86\RegSvr.exe
TargetObjectmatch\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
ImageeqC:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
TargetObjectmatch\{00000001-3DCC-4B48-A82E-E2071FE58E05}

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectmatch
  • \SOFTWARE\Microsoft\AMSI\Providers\
  • \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\