LegionLoader MSI LOLBin Execution with AppData Roaming File Drop

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects msiexec.exe being launched with installation flags (/i, /quiet, /q) from user-writable directories (AppData, Temp, Downloads), correlated with file creation in AppData\Roaming subdirectories. This pattern is characteristic of the LegionLoader malware, which drops and executes MSI installer packages to facilitate further infection stages.