Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Alerts on reg.exe or PowerShell command lines attempting to add/set AMSI enable registry settings.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-12-25
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process command lines that interact with AMSI-related registry settings, specifically targeting the Script Settings registry path and the AmsiEnable value. It looks for registry modification activity performed through reg.exe or PowerShell using common cmdlets and parameters. Such tampering matters because it can reduce or disable antimalware scanning visibility for malicious scripts, and the detection relies on process creation telemetry with command-line and executable identity fields.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Vulnerable Intel Ethernet Driver Load for BYOVD via SCATTERED SPIDER (via driver_load)

Malicious Defender Disable And Executable Exclusion Via Registry

Malicious UAC Disable via EnableLUA Registry Modification (via registry_set)

Malicious AMSI and ETW Patching via PowerShell Script

Malicious PowMix AMSI Bypass via amsiInitFailed

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

Suspicious Security Product Uninstall via wmic product call uninstall

Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Pivot detection · T1685 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-amsi-registry-tampering-via-reg-exe-or-powershell-comma-7dbbcac2

title: Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell
id: 903eca19-821f-4eb3-bfd0-15b22a1a5ceb
related:
  - id: aa37cbb0-da36-42cb-a90f-fdf216fc7467
    type: similar
  - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
    type: derived
status: experimental
description: This rule matches process command lines that interact with AMSI-related registry settings, specifically targeting the Script Settings registry path and the AmsiEnable value. It looks for registry modification activity performed through reg.exe or PowerShell using common cmdlets and parameters. Such tampering matters because it can reduce or disable antimalware scanning visibility for malicious scripts, and the detection relies on process creation telemetry with command-line and executable identity fields.
references:
  - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-25
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_key:
    CommandLine|contains|all:
      - \Software\Microsoft\Windows Script\Settings
      - AmsiEnable
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_cmd:
    CommandLine|contains: add
  selection_powershell_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_powershell_cmd:
    CommandLine|contains:
      - Set-ItemProperty
      - New-ItemProperty
      - "sp "
  condition: selection_key and (all of selection_powershell_* or all of selection_reg_*)
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering/info.yml
simulation:
  - type: atomic-red-team
    name: AMSI Bypass - Create AMSIEnable Reg Key
    technique: T1562.001
    atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL