LegionLoader Traiolx Custom Utils msvcr90.dll and 7z.dll Sideloading Staging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects file creation, modification, or module loading events involving specific DLL files ('msvcr90.dll' or '7z.dll') from a suspicious directory path ('Traiolx Custom Utils'). This behavior is commonly associated with DLL side-loading, where an adversary places malicious or renamed legitimate DLLs into a specific directory to hijack execution flow.