LegionLoader Anti-Debug and Sandbox Evasion via SEH and Debugger Check
This rule detects potential LegionLoader activity by monitoring for specific file staging in AppData/Roaming directories and suspicious registry queries related to security settings and Internet Explorer/Windows configuration values. The rule correlates process execution via msiexec.exe, rundll32.exe, or dllhost.exe with the creation of known staging artifacts and security-weakening registry modifications.
Microsoft Sentinel (KQL)
