Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

title: Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)
id: b5db911d-3827-4793-8d95-35a4af0c4f2e
status: test
description: This rule flags deletion of specific AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI. Removing these entries can be used by an attacker to impair or disable AMSI-based inspection. The detection relies on Windows registry delete telemetry for the matching TargetObject identifiers, with exclusions for common Windows Defender platform activity associated with MsMpEng.exe.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://seclists.org/fulldisclosure/2020/Mar/45
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml
author: frack113, Huntrule Team
date: 2021-06-07
modified: 2025-10-07
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_delete
detection:
  selection:
    TargetObject|endswith:
      - "{2781761E-28E0-4109-99FE-B9D127C57AFE}"
      - "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}"
  filter_main_defender:
    Image|startswith:
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Program Files\Windows Defender\
      - C:\Program Files (x86)\Windows Defender\
    Image|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key/info.yml
simulation:
  - type: atomic-red-team
    name: AMSI Bypass - Remove AMSI Provider Reg Key
    technique: T1562.001
    atomic_guid: 13f09b91-c953-438e-845b-b585e51cac9b
license: DRL-1.1
related:
  - id: 41d1058a-aea7-4952-9293-29eaaf516465
    type: derived