LegionLoader msiexec.exe Signed Binary Proxy Execution Spawning Suspicious Children

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where msiexec.exe spawns suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, or other common LOLBins, often associated with LegionLoader activity. The rule looks for suspicious command-line arguments (e.g., silent install flags, AppData paths, or specific artifacts like xupdate.bat or data.dat) indicative of malicious MSI-based proxy execution.