Windows Registry AMSI COM Server Hijacking via InProcServer32 CLSID Modification

title: Windows Registry AMSI COM Server Hijacking via InProcServer32 CLSID Modification
id: 63f11dc6-a31f-46b5-b7fc-94ca7e69fae4
status: test
description: This rule flags attempts to modify the InProcServer32 registry value for a specific AMSI-related COM CLSID, which can prevent AMSI from loading its COM server component. Attackers may use this defense-impairment technique to disrupt AMSI scanning functionality. The detection relies on registry set telemetry for the targeted CLSID InProcServer32 default value and excludes cases where the value points to %windir%\system32\amsi.dll.
references:
  - https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
  - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_amsi_com_hijack.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-04
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\(Default)
  filter:
    Details: "%windir%\\system32\\amsi.dll"
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 160d2780-31f7-4922-8b3a-efce30e63e96
    type: derived