AMSI.DLL Load By Uncommon Process
This rule detects when 'amsi.dll' is loaded by processes that are not commonly expected to load it. AMSI (Antimalware Scan Interface) is a Windows component that allows applications to integrate with installed antimalware products. Adversaries often attempt to bypass AMSI to execute malicious code without detection. This rule aims to identify such bypass attempts by flagging unusual process-AMSI.dll load combinations. The rule explicitly filters out common legitimate processes and directories that are known to load amsi.dll, such as explorer.exe, Sysmon64.exe, processes in Program Files, System32, SysWOW64, WinSxS, Windows Defender's MsMpEng.exe, and .NET framework related ngentask.exe processes.
Sigma
