DcRAT AMSI Bypass via AmsiOpenSession Patch and BCryptDecrypt .NET Load

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects the loading of amsi.dll in conjunction with command-line arguments that reference sensitive APIs often used to patch or disable the Antimalware Scan Interface (AMSI), such as VirtualProtect, GetProcAddress, or BCrypt-related functions.