Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Alerts on reg.exe or PowerShell command lines attempting to add/set AMSI enable registry settings.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-12-25
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process command lines that interact with AMSI-related registry settings, specifically targeting the Script Settings registry path and the AmsiEnable value. It looks for registry modification activity performed through reg.exe or PowerShell using common cmdlets and parameters. Such tampering matters because it can reduce or disable antimalware scanning visibility for malicious scripts, and the detection relies on process creation telemetry with command-line and executable identity fields.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)

Malicious FIN7 AvNeutralizer EDR Killer Execution via Masqueraded Binary (via process_creation)

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Pivot detection · T1685 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-amsi-registry-tampering-via-reg-exe-or-powershell-comma-7dbbcac2

title: Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell
id: 903eca19-821f-4eb3-bfd0-15b22a1a5ceb
related:
  - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467
    type: similar
  - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
    type: derived
status: experimental
description: This rule matches process command lines that interact with AMSI-related registry settings, specifically targeting the Script Settings registry path and the AmsiEnable value. It looks for registry modification activity performed through reg.exe or PowerShell using common cmdlets and parameters. Such tampering matters because it can reduce or disable antimalware scanning visibility for malicious scripts, and the detection relies on process creation telemetry with command-line and executable identity fields.
references:
  - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_key:
    CommandLine|contains|all:
      - \Software\Microsoft\Windows Script\Settings
      - AmsiEnable
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cmd:
    CommandLine|contains: add
  selection_powershell_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_powershell_cmd:
    CommandLine|contains:
      - Set-ItemProperty
      - New-ItemProperty
      - "sp "
  condition: selection_key and (all of selection_powershell_* or all of selection_reg_*)
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml
simulation:
  - type: atomic-red-team
    name: AMSI Bypass - Create AMSIEnable Reg Key
    technique: T1562.001
    atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL