Potential AMSI COM Server Hijacking
This rule detects attempts to hijack the Antimalware Scan Interface (AMSI) COM server by modifying a specific registry key. Adversaries can change the default value of the `InProcServer32` key for the AMSI CLSID (`{fdb00e52-a214-4aa1-8fba-4357bb0072ec}`) to point to a non-existent COM server. This action prevents AMSI from loading its COM component, effectively disabling its scanning functionalities and rendering it useless for malware detection.
Sigma
