LegionLoader msiexec.exe Spawning cmd.exe to Execute AppData Batch Script

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a suspicious execution chain associated with LegionLoader, where msiexec.exe is observed spawning cmd.exe to execute batch scripts located in temporary directories such as AppData\Roaming or system temp folders. This rule correlates an initial msiexec process initiation with a subsequent suspicious child process creation event on the same host.