huntrule

Windows AMSI.DLL Image Load by Uncommon Process Paths

Alerts when Amsi.dll is loaded by processes outside common Windows binaries and directories.

FreeReviewedSigma · Low · v5
Product
windows
Category
image_load
Author
frack113 (SigmaHQ), DRL 1.1
Published
2023-03-12
Updated
2026-07-31
AnalysisDetection
title: Windows AMSI.DLL Image Load by Uncommon Process Paths
id: 8c9da9fe-ebde-4491-988e-efdedaff791c
status: test
description: This rule flags Windows image loads where the loaded module ends with \amsi.dll and the loading process image path does not match common system or known benign locations. Attackers may load or proxy AMSI components to interfere with script and content scanning, making unusual load locations relevant to impact-focused hunting. The detection relies on image load telemetry containing Image and ImageLoaded fields to match \amsi.dll and apply exclusion filters for specific executable paths and directories.
references:
  - https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
  - https://github.com/TheD1rkMtr/AMSI_patch
  - https://github.com/surya-dev-singh/AmsiBypass-OpenSession
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml
author: frack113, Huntrule Team
date: 2023-03-12
modified: 2026-06-29
tags:
  - attack.impact
  - attack.t1490
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \amsi.dll
  filter_main_exact:
    Image|endswith:
      - :\Windows\explorer.exe
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
  filter_main_generic:
    Image|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
      - :\Windows\WinSxS\
  filter_optional_defender:
    Image|contains: :\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith: \MsMpEng.exe
  filter_main_dotnet:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
    Image|endswith: \ngentask.exe
  filter_main_null:
    Image: null
  filter_main_empty:
    Image: ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate third party apps installed in "ProgramData" and "AppData" might generate some false positives. Apply additional filters accordingly
level: low
license: DRL-1.1
related:
  - id: facd1549-e416-48e0-b8c4-41d7215eedc8
    type: derived