PCRE.NET Package Temporary File Creation
This rule detects the creation of temporary files in a specific path within the AppData\Local\Temp directory. The path contains a unique hash-like string, which is associated with the PCRE.NET package. This activity could indicate the execution or unpacking of applications that utilize the PCRE.NET library, potentially for malicious purposes such as code execution or payload delivery.
Sigma
