LegionLoader xupdate.bat Execution from AppData\Roaming\Traiolx Custom Utils

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of command-line scripts (specifically .bat files) located within the user's AppData\Roaming directory. It specifically flags execution attempts associated with 'xupdate.bat' or files containing 'Traiolx Custom Utils'. This activity is characteristic of malicious persistence or background utility execution often seen in various malware strains that attempt to camouflage their operation within user profile directories.