DcRAT AMSI Bypass: AmsiOpenSession Patch via VirtualProtect on amsi.dll
Detects potential Anti-Malware Scan Interface (AMSI) bypass attempts by identifying processes modifying the AmsiOpenSession function within amsi.dll memory using VirtualProtect, a technique observed in the DcRAT malware.
YARA-L
