LegionLoader MSI Temp File Payload Staging and Execution via msiexec

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects LegionLoader-like behavior where msiexec.exe creates a temporary MSI file in the system temp directory and subsequently executes it using the msiexec command line utility, a pattern often used to proxy malicious payload execution while evading detection.