Batch script disables AMSI, tampers SmartScreen registry before silent MSI install
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Microsoft Sentinel (KQL)
