LegionLoader Renamed MSI Installer Execution from Non-Standard Path
Detects the execution of 'msiexec.exe' where the installer package is located in suspicious or user-writable directories such as AppData, Temp, or Downloads. It specifically targets MSI files that do not follow standard naming conventions or use suspicious filename patterns, which is a common indicator of dropper or delivery behavior by adversaries.
Splunk (SPL)
