Suspicious process loads AMSI DLL

BIOC Informational

Suspicious process loads AMSI DLL

Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.

Module:: Platform Analytics
Agent event type:: Module
Category:: Execution
Status:: Enabled

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)

Indicator:

Image Load module path = *\amsi.dll Process initiated by = rundll32.exe , regasm.exe , installutil.exe , regsvcs.exe , regsvr32.exe AND initiator cmd != *printui.dll* AND *lenovo\* AND *\program files*\common files\vmware\* AND *\program files*\NVIDIA Corporation\* AND *PolicyAgentProvider.dll* AND *\windows\ccm\* AND *\windows\installer\* AND *GeneralTel.dll* AND *LogiLDA.dll* Host host os = windows

Preventable: yes