Windows Registry AMSI Provider Persistence via Providers Key
Alerts on registry activity creating/modifying AMSI provider entries under the Microsoft AMSI Providers keys.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags registry writes targeting the AMSI providers locations under HKLM, specifically paths containing \SOFTWARE\Microsoft\AMSI\Providers\ and \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\, which indicate creation or modification of AMSI provider entries. Adding new AMSI providers can be used to influence how AMSI content is scanned, potentially aiding evasion or persistence. It relies on registry set events that include the TargetObject (registry path) and the Image responsible for the change, with optional exclusions for specific vendor registration tools.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/amsi.html
- github.comhttps://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry AMSI Provider Persistence via Providers Key
id: 2cac784c-f1be-4b3e-9c9f-e6252d00b030
status: test
description: This rule flags registry writes targeting the AMSI providers locations under HKLM, specifically paths containing \SOFTWARE\Microsoft\AMSI\Providers\ and \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\, which indicate creation or modification of AMSI provider entries. Adding new AMSI providers can be used to influence how AMSI content is scanned, potentially aiding evasion or persistence. It relies on registry set events that include the TargetObject (registry path) and the Image responsible for the change, with optional exclusions for specific vendor registration tools.
references:
- https://persistence-info.github.io/Data/amsi.html
- https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/FakeAMSI/FakeAMSI.c
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2025-10-26
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \SOFTWARE\Microsoft\AMSI\Providers\
- \SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\
filter_optional_avast:
Image:
- C:\Program Files\Avast Software\Avast\RegSvr.exe
- C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
filter_optional_avg:
Image:
- C:\Program Files\AVG\Antivirus\RegSvr.exe
- C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
TargetObject|contains: \{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}
filter_optional_avira:
Image: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
TargetObject|contains: \{00000001-3DCC-4B48-A82E-E2071FE58E05}
condition: selection and not 1 of filter_optional_*
falsepositives:
- Legitimate security products adding their own AMSI providers. Filter these according to your environment.
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_amsi_providers/info.yml
license: DRL-1.1
related:
- id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f705
type: derived