DcRAT AMSI Bypass via AmsiOpenSession Memory Patch

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects attempts by malicious processes to disable AMSI (Antimalware Scan Interface) by memory-patching the AmsiOpenSession function. The rule monitors processes loading amsi.dll that match known loaders used by DcRAT malware, which use VirtualProtect to alter memory segments in order to bypass security scans of .NET payloads.