LegionLoader IE Registry Sandbox Evasion via AppData or msiexec Descendant

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious enumeration of Internet Explorer security zone registry keys, a known sandbox and debugger fingerprinting technique used by LegionLoader. The detection triggers when processes originating from AppData/Roaming or descending from msiexec.exe perform multiple registry reads on sensitive IE configuration keys within a one-minute window.