LegionLoader rundll32.exe DLL Execution from AppData\Roaming via msiexec/cmd Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where rundll32.exe is spawned by common command-line or installer processes (cmd.exe or msiexec.exe), often associated with malicious script execution or payload deployment from user-writable directories (AppData\Roaming) or using batch files.