DcRAT SendInfo Antivirus Enumeration via AMSI Patch and GetSystemInfo

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the DcRAT malware implant executing svchost.exe as a child process of 'Mixed Reality.exe', a behavior used during the malware's SendInfo phase to enumerate security products and prepare for AMSI patching.