huntrule

Windows Defender windefend AMSI Alert (Event ID 1116)

Flags Windows Defender AMSI detections via windefend Event ID 1116 with SourceName set to AMSI.

FreeUnreviewedSigmahighv1
title: Windows Defender windefend AMSI Alert (Event ID 1116)
id: 1ca382cc-3c25-4abc-a99c-4b7a3d4a35f3
status: stable
description: This rule flags Windows Defender detections where the antimalware platform reports an AMSI-triggered event (Event ID 1116) and identifies AMSI via SourceName. Such alerts can indicate script or in-memory execution behavior that the AMSI interface considers suspicious, which attackers may use to evade traditional file-based scanning. The detection relies on Windows Defender windefend event telemetry, specifically Event ID 1116 and the AMSI SourceName field.
references:
  - https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-09-14
modified: 2022-12-07
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 1116
    SourceName: AMSI
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ea9bf0fa-edec-4fb8-8b78-b119f2528186
    type: derived

What it detects

This rule flags Windows Defender detections where the antimalware platform reports an AMSI-triggered event (Event ID 1116) and identifies AMSI via SourceName. Such alerts can indicate script or in-memory execution behavior that the AMSI interface considers suspicious, which attackers may use to evade traditional file-based scanning. The detection relies on Windows Defender windefend event telemetry, specifically Event ID 1116 and the AMSI SourceName field.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.