LegionLoader msiexec.exe spawning cmd.exe to execute batch script from AppData\Roaming
This rule detects instances where 'msiexec.exe' spawns 'cmd.exe' to execute a batch or command file (.bat or .cmd) located within the 'AppData\Roaming' directory. This behavior can be indicative of malicious activity, as adversaries often use msiexec.exe for proxy execution and drop malicious scripts in user-writable directories like AppData.
Microsoft Sentinel (KQL)
