Windows Process Creation: AMSI Registry Tampering via reg.exe or PowerShell Command Line

title: "Windows Process Creation: AMSI Registry Tampering via reg.exe or PowerShell Command Line"
id: 903eca19-821f-4eb3-bfd0-15b22a1a5ceb
related:
  - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467
    type: similar
  - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
    type: derived
status: experimental
description: This rule flags process executions that modify AMSI-related registry settings by combining command-line evidence for AMSI enablement keys with registry or PowerShell property-setting commands. Such tampering matters because it can weaken malware scanning or script inspection capabilities. It relies on Windows process creation telemetry, capturing the process image (reg.exe or PowerShell) and the exact command-line strings used to add or set the registry values tied to the AMSI enable setting.
references:
  - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_key:
    CommandLine|contains|all:
      - \Software\Microsoft\Windows Script\Settings
      - AmsiEnable
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cmd:
    CommandLine|contains: add
  selection_powershell_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_powershell_cmd:
    CommandLine|contains:
      - Set-ItemProperty
      - New-ItemProperty
      - "sp "
  condition: selection_key and (all of selection_powershell_* or all of selection_reg_*)
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml
simulation:
  - type: atomic-red-team
    name: AMSI Bypass - Create AMSIEnable Reg Key
    technique: T1562.001
    atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
license: DRL-1.1