LegionLoader DLL Sideloading via 7z.dll or normaliz.dll from AppData

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the loading of specific DLLs (7z.dll, normaliz.dll) from user-writable directories like AppData, Temp, Roaming, or Local, excluding legitimate installations of 7-Zip or Windows system directories. This behavior can indicate DLL sideloading or other forms of malicious code execution where an attacker places a malicious DLL in a location that a legitimate application will load.