LegionLoader MSI Installer Spawning cmd.exe with Batch Script in AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with command line arguments containing suspicious keywords such as 'AppData\Roaming', '.bat', 'xupdate.bat', or 'Traiolx Custom Utils'. This behavior is indicative of potentially malicious installation or post-exploitation activities.