LegionLoader dllhost.exe CPL/COM Proxy Execution with AppData Staging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the LegionLoader infection chain, specifically identifying the use of dllhost.exe as a proxy to load malicious .cpl files or COM objects (e.g., COpenControlPanel) from AppData\Roaming. This rule correlates an initial msiexec.exe MSI staging event with the subsequent dllhost.exe execution and its child process spawn behavior within a 30-minute window.