LegionLoader Multi-File Payload Staging in AppData\Roaming Subdirectory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.