Tag
high
advisory
AMSI Enable Registry Key Modification for Defense Evasion
2 rules 1 TTPAdversaries modify the AmsiEnable registry key to 0 to disable Windows Script AMSI scanning, bypassing AMSI protections for Windows Script Host or JScript execution.
Microsoft Defender XDR +4
defense-evasion
amsi
registry
windows
2r
1t
high
advisory
Potential Antimalware Scan Interface Bypass via PowerShell
3 rules 1 TTPThis rule detects PowerShell scripts that attempt to bypass the Antimalware Scan Interface (AMSI) in order to disable scanning and execute malicious PowerShell code undetected.
defense-evasion
amsi
powershell
windows
3r
1t
high
advisory
AMSI Disablement via Registry Modification
2 rulesAttackers disable the Antimalware Scan Interface (AMSI) by modifying the Windows registry value 'AmsiEnable' to '0x00000000' to evade detection, commonly employed by ransomware, RATs, and APTs.
Windows +3
amsi
defense-evasion
registry-modification
ransomware
2r