DcRAT AMSI Bypass via amsi.dll VirtualProtect In-Memory Patch
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Splunk (SPL)
