Potential Persistence Via New AMSI Providers - Registry
Detects when an attacker registers a new AMSI provider in the Windows Registry to establish persistence. This technique involves creating or modifying registry keys under `SOFTWARE\Microsoft\AMSI\Providers\` or `SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\` to load a malicious DLL when AMSI is initialized. The rule filters out legitimate system processes that might perform similar actions from standard Windows and Program Files directories.
Sigma
