Windows Defender AMSI Trigger Detected

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.