Windows AMSI.DLL Image Load by Uncommon Process Paths
Alerts when Amsi.dll is loaded by processes outside common Windows binaries and directories.
- Product
- windows
- Category
- image_load
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-03-12
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows image loads where the loaded module ends with \amsi.dll and the loading process image path does not match common system or known benign locations. Attackers may load or proxy AMSI components to interfere with script and content scanning, making unusual load locations relevant to impact-focused hunting. The detection relies on image load telemetry containing Image and ImageLoaded fields to match \amsi.dll and apply exclusion filters for specific executable paths and directories.
Reporting behind it
- infosecwriteups.comhttps://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
- github.comhttps://github.com/TheD1rkMtr/AMSI_patch
- github.comhttps://github.com/surya-dev-singh/AmsiBypass-OpenSession
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AMSI.DLL Image Load by Uncommon Process Paths
id: 8c9da9fe-ebde-4491-988e-efdedaff791c
status: test
description: This rule flags Windows image loads where the loaded module ends with \amsi.dll and the loading process image path does not match common system or known benign locations. Attackers may load or proxy AMSI components to interfere with script and content scanning, making unusual load locations relevant to impact-focused hunting. The detection relies on image load telemetry containing Image and ImageLoaded fields to match \amsi.dll and apply exclusion filters for specific executable paths and directories.
references:
- https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
- https://github.com/TheD1rkMtr/AMSI_patch
- https://github.com/surya-dev-singh/AmsiBypass-OpenSession
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml
author: frack113, Huntrule Team
date: 2023-03-12
modified: 2026-06-29
tags:
- attack.impact
- attack.t1490
- detection.threat-hunting
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \amsi.dll
filter_main_exact:
Image|endswith:
- :\Windows\explorer.exe
- :\Windows\Sysmon64.exe
- :\Windows\Sysmon64a.exe
filter_main_generic:
Image|contains:
- :\Program Files (x86)\
- :\Program Files\
- :\Windows\System32\
- :\Windows\SysWOW64\
- :\Windows\WinSxS\
filter_optional_defender:
Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
Image|endswith: \MsMpEng.exe
filter_main_dotnet:
Image|contains:
- :\Windows\Microsoft.NET\Framework\
- :\Windows\Microsoft.NET\Framework64\
- :\Windows\Microsoft.NET\FrameworkArm\
- :\Windows\Microsoft.NET\FrameworkArm64\
Image|endswith: \ngentask.exe
filter_main_null:
Image: null
filter_main_empty:
Image: ""
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate third party apps installed in "ProgramData" and "AppData" might generate some false positives. Apply additional filters accordingly
level: low
license: DRL-1.1
related:
- id: facd1549-e416-48e0-b8c4-41d7215eedc8
type: derived