Windows AMSI Disabled by Registry Value Modification (AmsiEnable)
Alerts when Windows Script Settings AmsiEnable is set to 0x00000000 to disable AMSI.
- Product
- windows
- Category
- registry_set
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-12-25
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry modifications that set the AmsiEnable value under the Script Settings path to DWORD 0x00000000. Disabling AMSI can reduce the ability of security products to scan script content and other dynamic content for malicious behavior. It relies on telemetry from registry set events that capture the targeted registry key path and the value details written by the process.
Reporting behind it
- mostafayahiax.medium.comhttps://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
- docs.microsoft.comhttps://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
- mdsec.co.ukhttps://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_amsi_disable.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AMSI Disabled by Registry Value Modification (AmsiEnable)
id: 7ff4d205-120c-4ae9-b2c1-399e24f3dd47
related:
- id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
type: similar
- id: aa37cbb0-da36-42cb-a90f-fdf216fc7467
type: derived
status: experimental
description: This rule flags Windows registry modifications that set the AmsiEnable value under the Script Settings path to DWORD 0x00000000. Disabling AMSI can reduce the ability of security products to scan script content and other dynamic content for malicious behavior. It relies on telemetry from registry set events that capture the targeted registry key path and the value details written by the process.
references:
- https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
- https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
- https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_amsi_disable.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml
simulation:
- type: atomic-red-team
name: AMSI Bypass - Create AMSIEnable Reg Key
technique: T1562.001
atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
license: DRL-1.1