huntrule

Windows: Creation of PCRE.NET Package Temp Files via AppData\Local\Temp Path

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

FreeUnreviewedSigmahighv1
title: "Windows: Creation of PCRE.NET Package Temp Files via AppData\\Local\\Temp Path"
id: bc0b9dd1-a9be-4dbd-afad-b3d276d8740c
status: test
description: This rule flags file creation events where the target filename contains a specific temporary path segment under AppData\Local\Temp associated with a PCRE.NET package cache location. Attackers may leverage such temporary artifacts to stage or execute payloads, making these file writes a useful behavioral indicator. It relies on Windows file event telemetry that includes the full target filename.
references:
  - https://twitter.com/rbmaslen/status/1321859647091970051
  - https://twitter.com/tifkin_/status/1321916444557365248
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6e90ae7a-7cd3-473f-a035-4ebb72d961da
    type: derived

What it detects

This rule flags file creation events where the target filename contains a specific temporary path segment under AppData\Local\Temp associated with a PCRE.NET package cache location. Attackers may leverage such temporary artifacts to stage or execute payloads, making these file writes a useful behavioral indicator. It relies on Windows file event telemetry that includes the full target filename.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.