Skip to content
Threat Feed
Subscribe

Tag

Amsi

4 briefs RSS
high advisory

AMSI Enable Registry Key Modification for Defense Evasion

Adversaries modify the AmsiEnable registry key to 0 to disable Windows Script AMSI scanning, bypassing AMSI protections for Windows Script Host or JScript execution.

Microsoft Defender XDR +4 defense-evasion amsi registry windows
2r 1t
high advisory

Potential Antimalware Scan Interface Bypass via PowerShell

This rule detects PowerShell scripts that attempt to bypass the Antimalware Scan Interface (AMSI) in order to disable scanning and execute malicious PowerShell code undetected.

defense-evasion amsi powershell windows
3r 1t
high advisory

Suspicious Antimalware Scan Interface DLL Creation

The rule detects the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location, potentially indicating an attempt to bypass AMSI by loading a rogue AMSI module, a technique used for defense evasion.

Windows amsi dll-hijacking defense-evasion
2r 2t
high advisory

AMSI Disablement via Registry Modification

Attackers disable the Antimalware Scan Interface (AMSI) by modifying the Windows registry value 'AmsiEnable' to '0x00000000' to evade detection, commonly employed by ransomware, RATs, and APTs.

Windows +3 amsi defense-evasion registry-modification ransomware
2r