LegionLoader IE Registry Enumeration for Sandbox/Debugger Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious modifications to registry keys associated with Internet Explorer, Windows Internet Settings, or Windows NT configuration. It specifically looks for activity involving processes running from suspicious locations (e.g., AppData) or common abuse vectors like cmd.exe and msiexec.exe that perform these registry changes repeatedly, which may indicate persistence mechanisms or defense evasion.