LegionLoader Persistence: schtasks /create After MSI Execution in User Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.