Windows Processes Creating PCRE.NET Temp Package Files
Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.
- Product
- windows
- Category
- file_event
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-10-29
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies file events where a process creates a file in the Windows user temporary directory containing a specific PCRE.NET package temp filename fragment. Attackers and installers may write transient artifacts to Temp to execute or stage components, so matching these unique temp paths can highlight suspicious local activity. It relies on file creation or file event telemetry that includes the target filename for Windows.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Processes Creating PCRE.NET Temp Package Files
id: bc0b9dd1-a9be-4dbd-afad-b3d276d8740c
status: test
description: This rule identifies file events where a process creates a file in the Windows user temporary directory containing a specific PCRE.NET package temp filename fragment. Attackers and installers may write transient artifacts to Temp to execute or stage components, so matching these unique temp paths can highlight suspicious local activity. It relies on file creation or file event telemetry that includes the target filename for Windows.
references:
- https://twitter.com/rbmaslen/status/1321859647091970051
- https://twitter.com/tifkin_/status/1321916444557365248
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
- attack.execution
- attack.t1059
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 6e90ae7a-7cd3-473f-a035-4ebb72d961da
type: derived