Elastic Defend high stable eql

AMSI Bypass via COM Registry Modification

Identifies attempts to disable the Microsoft Antimalware Scan Interface via registry modification. This may indicate an attempt to tamper with certain Windows native protections.

View Source

Detection Logic

registry where event.action == "modification" and  
 registry.path : "HKEY_USERS\\*_Classes\\CLSID\\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\\InProcServer*" and 
 not registry.data.strings : ("?:\\Windows\\System32\\amsi.dll", "?:\\Windows\\SysWOW64\\amsi.dll")

Field Validations

Loading…

Comments (0)

Loading comments...