LegionLoader: msiexec.exe Spawns cmd.exe Executing Batch Script from AppData\Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) to execute a batch file located within the user's AppData roaming directory. This behavior is frequently associated with the deployment of malicious payloads or dropper scripts that leverage legitimate installers to maintain persistence or execute unauthorized code.