Windows Image Load of PCRE.NET Package Temp Module Path
Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.
- Product
- windows
- Category
- image_load
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-10-29
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes loading an image from a specific temporary file path associated with the PCRE.NET package. Attackers may stage or execute assemblies or native components from user-writable temp directories to run code without relying on well-known install locations. Detection relies on image load telemetry that records the full loaded module path, matching the configured temp directory substring.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Image Load of PCRE.NET Package Temp Module Path
id: 8b5d8729-bd23-443b-be75-9c7a9d70baf7
status: test
description: This rule identifies Windows processes loading an image from a specific temporary file path associated with the PCRE.NET package. Attackers may stage or execute assemblies or native components from user-writable temp directories to run code without relying on well-known install locations. Detection relies on image load telemetry that records the full loaded module path, matching the configured temp directory substring.
references:
- https://twitter.com/rbmaslen/status/1321859647091970051
- https://twitter.com/tifkin_/status/1321916444557365248
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
- attack.execution
- attack.t1059
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 84b0a8f3-680b-4096-a45b-e9a89221727c
type: derived