LegionLoader msiexec.exe spawning cmd.exe to run xupdate.bat from AppData\Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•1

Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.