LegionLoader msiexec.exe Spawning rundll32.exe via LOLBin Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution chain where msiexec.exe spawns rundll32.exe, a pattern observed in LegionLoader to proxy malicious DLL execution. The rule monitors for rundll32.exe command lines referencing common user-writable or staging directories such as AppData, Temp, or ProgramData, which are often used to host malicious payloads, while excluding known legitimate DLLs.