LegionLoader rundll32.exe LOLBin Abuse via msiexec.exe or cmd.exe Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•3

Detects the execution of rundll32.exe when initiated by msiexec.exe or cmd.exe, particularly when the rundll32.exe process path or command line involves the AppData\Roaming directory or references specific custom utilities, which is a common pattern for fileless or staged malware execution.