Suspicious AMSI Disabled through Registry Change (via registry_set)

This rule detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that enables applications and services to integrate with anti-malware products for enhanced protection against hostile content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute hostile scripts or code without being scanned.