DragonReturn AMSI Bypass via AmsiOpenSession Patch to -277

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects unauthorized modifications to the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for calls to VirtualProtect or VirtualProtectEx when directed at amsi.dll or attempting to patch AmsiOpenSession, which is a common technique used by malware to disable AMSI scanning capabilities and evade EDR/AV inspection.