Windows Registry AMSI Provider Persistence via Providers Key

title: Windows Registry AMSI Provider Persistence via Providers Key
id: 2cac784c-f1be-4b3e-9c9f-e6252d00b030
status: test
description: This rule flags registry writes targeting the AMSI providers locations under HKLM, specifically paths containing \SOFTWARE\Microsoft\AMSI\Providers\ and \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\, which indicate creation or modification of AMSI provider entries. Adding new AMSI providers can be used to influence how AMSI content is scanned, potentially aiding evasion or persistence. It relies on registry set events that include the TargetObject (registry path) and the Image responsible for the change, with optional exclusions for specific vendor registration tools.
references:
  - https://persistence-info.github.io/Data/amsi.html
  - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2025-10-26
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Microsoft\AMSI\Providers\
      - \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\
  filter_optional_avast:
    Image:
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
      - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
    TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
  filter_optional_avg:
    Image:
      - C:\Program Files\AVG\Antivirus\RegSvr.exe
      - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
    TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
  filter_optional_avira:
    Image: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
    TargetObject|contains: \{00000001-3DCC-4B48-A82E-E2071FE58E05}
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate security products adding their own AMSI providers. Filter these according to your environment.
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml
license: DRL-1.1
related:
  - id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705
    type: derived