Windows AMSI Disabled by Registry Value Modification (AmsiEnable)

title: Windows AMSI Disabled by Registry Value Modification (AmsiEnable)
id: 7ff4d205-120c-4ae9-b2c1-399e24f3dd47
related:
  - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
    type: similar
  - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467
    type: derived
status: experimental
description: This rule flags Windows registry modifications that set the AmsiEnable value under the Script Settings path to DWORD 0x00000000. Disabling AMSI can reduce the ability of security products to scan script content and other dynamic content for malicious behavior. It relies on telemetry from registry set events that capture the targeted registry key path and the value details written by the process.
references:
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_amsi_disable.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml
simulation:
  - type: atomic-red-team
    name: AMSI Bypass - Create AMSIEnable Reg Key
    technique: T1562.001
    atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
license: DRL-1.1