LegionLoader Payload Staging in AppData\Roaming via cmd.exe and Batch Script
Detects instances where msiexec.exe or cmd.exe initiates a child process, specifically cmd.exe, to execute a batch file (.bat) located within the user's AppData/Roaming directory. This behavior is indicative of potential malicious activity, as adversaries often store and execute payloads in user-writable application data directories to maintain persistence or evade detection.
SentinelOne
