LegionLoader DLL Sideload - Malicious 7z.dll or normaliz.dll in Traiolx Custom Utils

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

This rule detects when known DLL files (7z.dll or normaliz.dll) are loaded by a process from a file path containing 'Traiolx Custom Utils'. This pattern is often indicative of DLL side-loading or hijacking, where an adversary places malicious or proxy DLLs in a custom directory to be loaded by a legitimate application.