Operation DragonReturn AMSI Bypass via AmsiOpenSession Memory Patching
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
CQL
