LegionLoader: Dynamic API Resolution with Encoded Pointers via LoadLibraryA and GetProcAddress

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.