new: AMSI Disabled via Registry Modification

[swachchhanda000]

Summary of the Pull Request

Changelog

new: Windows AMSI Related Registry Tampering Via CommandLine
new: AMSI Disabled via Registry Modification

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull request overview

This PR adds two new Sigma detection rules for identifying attempts to disable Windows AMSI (Anti-Malware Scan Interface) through different methods. The rules target adversaries trying to evade detection by disabling AMSI, a security feature that allows applications to integrate with anti-malware products.

• Adds a registry modification detection rule for AMSI disable attempts
• Adds a process creation detection rule for AMSI disable command execution
• Includes comprehensive regression test data for both detection rules

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
rules/windows/registry/registry_set/registry_set_amsi_disable.yml	New rule detecting AMSI disable via registry modification of AmsiEnable value
rules/windows/process_creation/proc_creation_win_amsi_disable.yml	New rule detecting AMSI disable via command-line execution (reg.exe or PowerShell)
regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml	Test metadata for registry modification detection rule
regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/aa37cbb0-da36-42cb-a90f-fdf216fc7467.json	Sample event data for registry modification test
regression_data/rules/windows/process_creation/proc_creation_win_amsi_disable/info.yml	Test metadata for process creation detection rule
regression_data/rules/windows/process_creation/proc_creation_win_amsi_disable/7dbbcac2-57a0-45ac-b306-ff30a8bd2981.json	Sample event data for process creation test

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.