LegionLoader Anti-Debug SEH/API Resolution via Traiolx Custom Utils Staging Dir

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

This rule monitors for processes running from a specific directory under 'AppData\Roaming\traiolx custom utils\' that load critical Windows system libraries ('user32.dll' or 'kernel32.dll'). This behavior is indicative of DLL side-loading or masquerading where an executable in a non-standard, user-writable directory attempts to load core system components, a common tactic used by malware to establish persistence or run malicious code.