Detection rules › Sigma
Potential Persistence Via New AMSI Providers - Registry
Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections. Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content. This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
Known false positives
- Legitimate security products adding their own AMSI providers. Filter these according to your environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule body
title: Potential Persistence Via New AMSI Providers - Registry
id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705
status: test
description: |
Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections.
Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
references:
- https://persistence-info.github.io/Data/amsi.html
- https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2025-10-26
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- '\SOFTWARE\Microsoft\AMSI\Providers\'
- '\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\'
filter_optional_avast:
Image:
- 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
- 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avg:
Image:
- 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
- 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avira:
Image: 'C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe'
TargetObject|contains: '\{00000001-3DCC-4B48-A82E-E2071FE58E05}'
condition: selection and not 1 of filter_optional_*
falsepositives:
- Legitimate security products adding their own AMSI providers. Filter these according to your environment.
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_optional_*Stage 1: selection
selection:
TargetObject|contains:
- '\SOFTWARE\Microsoft\AMSI\Providers\'
- '\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\'
Stage 2: not filter_optional_*
filter_optional_avast:
Image:
- 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
- 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avg:
Image:
- 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
- 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
TargetObject|contains: '\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}'
filter_optional_avira:
Image: 'C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe'
TargetObject|contains: '\{00000001-3DCC-4B48-A82E-E2071FE58E05}'
Exclusions
The rule actively suppresses these predicates.
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | match |
| field:"TargetObject" kind:match |