LegionLoader: IE Registry Enumeration for Sandbox/Debugger Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects registry queries targeting Internet Explorer security configuration keys, such as 'WarnOnHTTPSToHTTPRedirect' or those within the 'Internet Explorer\Security' path. These queries may indicate an attempt to identify or modify security settings to facilitate malicious activities like bypassing security warnings or weakening browser protection.