LegionLoader: MSI-Prefixed Temp File Creation in Windows Temp Directory
Detects the creation of temporary files in Windows Temp or SystemTemp directories that match the naming patterns used by the Windows Installer (MSI) service. These files, often starting with 'MSI' or '~DF' and ending in '.tmp' or '.TMP', are typically legitimate installer artifacts, but suspicious patterns or unexpected execution locations may indicate staging of malicious installers.
CQL
