DcRAT AMSI Bypass via AmsiOpenSession Patch with VirtualProtect

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects DcRAT loader attempts to disable AMSI scanning by patching the AmsiOpenSession function in amsi.dll memory using VirtualProtect, a technique associated with malware such as DcRAT and historical campaigns like Operation DragonReturn.