LegionLoader cmd.exe Batch Script Execution from AppData Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of batch (.bat/.cmd) scripts located within the AppData\Roaming directory via cmd.exe. This behavior is indicative of LegionLoader multi-stage infection chains, particularly when initiated by msiexec.exe. Legitimate software update processes are excluded to minimize false positives.