Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,048 copies47 likes38,291 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects msiexec.exe being launched with installation flags (/i, /quiet, /q) from user-writable directories (AppData, Temp, Downloads), correlated with file creation in AppData\Roaming subdirectories. This pattern is characteristic of the LegionLoader malware, which drops and executes MSI installer packages to facilitate further infection stages.
Detects a suspicious execution chain associated with LegionLoader, where a malicious DLL (e.g., normaliz.dll or 7z.dll) is staged in the AppData\Roaming directory followed by the execution of rundll32.exe spawned by msiexec.exe or cmd.exe to load the staged DLL.
Detects a suspicious execution chain associated with LegionLoader, where msiexec.exe is observed spawning cmd.exe to execute batch scripts located in temporary directories such as AppData\Roaming or system temp folders. This rule correlates an initial msiexec process initiation with a subsequent suspicious child process creation event on the same host.
Detects the LegionLoader malware behavior where a password-protected .dat archive is created in the AppData\Roaming directory followed by the execution of 7z.exe or 7za.exe to extract the hidden payload.
Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
Detects suspicious enumeration of Internet Explorer security zone registry keys, a known sandbox and debugger fingerprinting technique used by LegionLoader. The detection triggers when processes originating from AppData/Roaming or descending from msiexec.exe perform multiple registry reads on sensitive IE configuration keys within a one-minute window.
Detects the LegionLoader malware using a malicious normaliz.dll staged in user-writable directories (AppData\Roaming\Traiolx Custom Utils) to perform DLL sideloading. The rule correlates this malicious module load with suspicious LOLBin behavior where msiexec.exe executes cmd.exe, forming a known infection chain.
Detects the execution of Python interpreters from user-writable AppData\Roaming directories initiating external network connections. This behavior is consistent with the execution of LegionLoader malware and its associated _socket.pyd Python C2 module.
Detects the LegionLoader malware execution chain, specifically identifying the side-loading of a malicious 7z.dll file placed in user-writable directories (e.g., AppData, Temp) instead of legitimate 7-Zip installation paths. This rule correlates the file creation event with the suspicious behavior of msiexec.exe launching cmd.exe, a characteristic pattern of the LegionLoader LOLBin execution flow.
Page 980 of 1168