AMSI COM Server Hijacking
An adversary can disable Microsoft Antimalware Scan Interface (AMSI) scanning capabilities by hijacking the COM server registry key used during AMSI initialization, causing the component to fail load.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 13, 06:51 UTC
- Detection
- 1 rule
- Source quality
- A1Very likely
Attackers can bypass AMSI by modifying the registry key associated with its COM server (CLSID {fdb00e52-a214-4aa1-8fba-4357bb0072ec}). When the COM server is redirected to a non-existent location, the AMSI component fails to load, rendering the security scanning interface useless for the compromised process.
Impact
Successful exploitation results in the complete disabling of AMSI for affected processes, allowing malicious scripts and payloads to execute without being scanned or intercepted by security tools that rely on AMSI integration.
Recommendation
Detection teams should monitor registry modifications to the AMSI COM server CLSID. Deploy the provided Sigma rule to alert on any modification where the default InProcServer32 value is not the legitimate amsi.dll.
Immediate actions
Deploy Sigma rule to detect unauthorized modifications to the AMSI COM server registry key.
Detection coverage 1
Potential AMSI COM Server Hijacking
highDetects unauthorized modifications to the AMSI COM server registry key used to disable AMSI scanning.
Detection queries are available on the platform. Get full rules →