BIOC
Low
✕
Suspicious AMSI DLL load location
An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).
- Module:
- Platform Analytics
- Agent event type:
- Module
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
Indicator:
Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows
Preventable: yes