LegionLoader Payload Staging in AppData\Roaming via Renamed Installers
Detects the execution of files with .exe, .msi, or .bat extensions located within the user AppData Roaming directory. This path is frequently abused by malware, droppers, and persistence mechanisms to execute code in a directory that is typically writable by the user without requiring elevated administrative privileges.
CQL
