LegionLoader Dynamic API Resolution via LoadLibraryA+GetProcAddress in AppData\Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects behavior indicative of LegionLoader where an unsigned process spawned by msiexec.exe or cmd.exe from the AppData\Roaming directory dynamically loads system DLLs (ntdll.dll, kernel32.dll, etc.) followed immediately by API function resolution via GetProcAddress. This sequence is a common technique used by malware to obfuscate function imports, evade static analysis, and hide malicious functionality.