LegionLoader Payload Staging via MSI and Batch Scripts in AppData\Roaming
Detects the execution of msiexec.exe or batch files from the AppData Roaming directory, as well as msiexec.exe spawning cmd.exe. These behaviors are frequently associated with staging and executing malicious payloads in user-writable directories.
Microsoft Sentinel (KQL)
