LegionLoader Sideloading via Traiolx Custom Utils Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of specific utilities (e.g., 7zip components, socket modules) originating from a non-standard directory named 'AppData\Roaming\Traiolx Custom Utils'. This pathing pattern is indicative of potential malware staging or the execution of custom tooling in an attempt to masquerade as legitimate software.