DcRAT AMSI Bypass via AmsiOpenSession In-Memory Patch to Return -277

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects processes that load 'amsi.dll' while concurrently performing suspicious memory or API activities often associated with AMSI bypass techniques, such as calling 'VirtualProtect' to change memory permissions or using API resolution functions like 'AmsiOpenSession', 'GetProcAddress', or 'GetModuleHandleA'. This pattern is commonly used by adversaries to disable or subvert the Antimalware Scan Interface.