Windows Image Load of Temp Module Containing PCRE.NET Package Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

FreeUnreviewedSigmahighv1

windows-image-load-of-temp-module-containing-pcre-net-package-path-84b0a8f3

title: Windows Image Load of Temp Module Containing PCRE.NET Package Path
id: 8b5d8729-bd23-443b-be75-9c7a9d70baf7
status: test
description: This rule flags process image loads where the loaded module path includes a specific temporary directory string associated with a PCRE.NET package component. Attackers may stage or load executable content from user-writable temp locations to run code indirectly. The detection relies on Windows image load telemetry that captures the full ImageLoaded path and matches it for the embedded temp module substring.
references:
  - https://twitter.com/rbmaslen/status/1321859647091970051
  - https://twitter.com/tifkin_/status/1321916444557365248
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-29
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: \AppData\Local\Temp\ba9ea7344a4a5f591d6e5dc32a13494b\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 84b0a8f3-680b-4096-a45b-e9a89221727c
    type: derived

What it detects

This rule flags process image loads where the loaded module path includes a specific temporary directory string associated with a PCRE.NET package component. Attackers may stage or load executable content from user-writable temp locations to run code indirectly. The detection relies on Windows image load telemetry that captures the full ImageLoaded path and matches it for the embedded temp module substring.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.