LegionLoader msiexec.exe MSI Silent Install Spawning cmd.exe to AppData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where the Windows Installer (msiexec.exe) initiates a command prompt (cmd.exe) session from an AppData directory. This behavior is indicative of potential malicious activity, as installers are sometimes abused to proxy execution of payloads residing in user-writable temporary directories.