Bumblebee - Trojanized MSI Execution via SEO Poisoning

Ibrahim Saud@tektrix

•updated Jun 29, 2026•3•0•8

Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.