Why is svchost.exe on Windows 11 Frequently Accessing AMSI-related Registry Keys?

Svchost.exe in Windows 11 Frequently Accessing AMSI-related Registry Keys

Microsoft's svchost.exe is a legitimate system process responsible for hosting multiple Windows services in the same process. However, if you've noticed that svchost.exe in your Windows 11 system repeatedly attempts to access AMSI (Antimalware Scan Interface) related registry keys, it might raise some security concerns.

What is AMSI?

AMSI is a Windows interface that allows applications and services, like antivirus software, to integrate with the operating system's security features. It facilitates the scanning of scripts and executables at runtime to detect potentially malicious behavior or threats.

Why does svchost.exe access AMSI-related registry keys?

Various Windows services hosted by svchost.exe might need to interact with AMSI for security reasons, such as the Windows Defender service (WinDefend). It's not unusual for svchost.exe to access AMSI-related registry keys occasionally, but frequent or continuous attempts might indicate suspicious or abnormal behavior.

Finding the root cause

To find out which specific service or application hosted by svchost.exe is causing these frequent access attempts, you can use the Process Monitor tool from Sysinternals.

Registry keys to monitor:
 HKLM\SOFTWARE\Microsoft\Windows Defender
 HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
 HKLM\SYSTEM\ControlSet001\Services\WinDefend
 HKLM\SYSTEM\ControlSet001\Control\AntimalwareScanning

Follow these steps to filter the Process Monitor results:

1. Run Process Monitor as an administrator.
2. In the Filter menu, click Filter....
3. In the Filter dialog, click the Include tab.
4. In the Path column drop-down menu, choose begins with and enter the monitored registry keys one-by-one.
5. After adding the keys, click Apply and OK.
6. You should now see which process and service are causing the frequent access attempts.

Is this behavior malicious?

While frequent access attempts can be a sign of malicious behavior, it is not a definitive indicator. If you've identified a legitimate Windows service or application causing this, you have no reason to worry. However, if you suspect malware, consider the following actions:

1. Update and run a full system scan using your antivirus software.
2. Check for any recently installed applications or suspicious files on your computer.
3. Restore your system to a previous restore point.

• Svchost.exe in Windows 11 frequently accessing AMSI-related registry keys should not be a cause for alarm in most cases. Use Process Monitor to find the process and service causing the access attempts.
• While frequent access attempts can sometimes suggest malicious behavior, it's not a definitive indicator. If you find a legitimate Windows service causing it, there is no need for concern.
• Keep your system up-to-date and run regular antivirus scans to ensure your system's security.

References

• Antimalware Scan Interface (AMSI)
• Process Monitor (Procmon)
• svchost.exe / Windows Defender constantly accessing registry keys