Operation DragonReturn AMSI Bypass via AmsiOpenSession VirtualProtect Patch

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.