LegionLoader Sandbox Evasion via IsDebuggerPresent and SEH Manipulation
This rule detects various behaviors associated with the LegionLoader malware, including suspicious process execution (msiexec/cmd spawning cmd/rundll32/dllhost via AppData), anti-debugging API calls (IsDebuggerPresent, SetUnhandledExceptionFilter), and specific registry modifications targeting Internet Explorer security settings used for sandbox evasion.
Splunk (SPL)
