LegionLoader msiexec.exe Spawning cmd.exe with AppData Batch Script
This rule detects instances where msiexec.exe spawns cmd.exe to execute a batch file located within the user's AppData\Roaming directory. This pattern is indicative of potential malicious activity where msiexec is abused as a proxy for command execution, often used by malware to launch secondary stages from user-writable directories.
Splunk (SPL)
