Operation DragonReturn DcRAT AMSI Bypass via AmsiOpenSession In-Memory Patching
Detects a suspicious sequence of events associated with the Operation DragonReturn DcRAT campaign. The rule monitors for the loading of amsi.dll followed by bcrypt.dll within a 5-minute window by specific processes (e.g., Mixed Reality.exe). This pattern is indicative of an AMSI in-memory bypass via AmsiOpenSession patching, followed by the decryption and loading of a .NET assembly, commonly used to maintain stealth during malware execution.
Microsoft Sentinel (KQL)
