LegionLoader Registry Enumeration for Sandbox and Environment Fingerprinting
Detects registry queries targeting Internet Explorer security, Windows NT versions, and Internet settings, which are commonly used by LegionLoader for environment fingerprinting and sandbox evasion during the initial staging phase.
Microsoft Sentinel (KQL)
