LegionLoader Normaliz.dll Sideload from Traiolx AppData Staging Dir

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the LegionLoader malware using a malicious normaliz.dll staged in user-writable directories (AppData\Roaming\Traiolx Custom Utils) to perform DLL sideloading. The rule correlates this malicious module load with suspicious LOLBin behavior where msiexec.exe executes cmd.exe, forming a known infection chain.