LegionLoader process enumeration via wmic.exe or tasklist.exe as child of msiexec.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects instances where msiexec.exe, a legitimate Windows Installer utility, spawns discovery tools like wmic.exe or tasklist.exe. This behavior can be indicative of an adversary using msiexec.exe for proxy execution to gather system information, potentially bypassing security controls. The detection looks for wmic.exe or tasklist.exe being launched within a 2-minute window of msiexec.exe, with specific command-line arguments often used for process or system listing, and where msiexec.exe or cmd.exe is the initiating process or parent process.