LegionLoader 7z.exe Extracting data.dat Payload in Traiolx Custom Utils Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potentially malicious search queries within Microsoft 365 network traffic. It monitors HTTP headers and request bodies for search parameters that contain common web injection markers, such as script, img, or svg tags, and other suspicious keywords indicative of attempted Cross-Site Scripting (XSS) or search-based exploitation.