Glove Stealer PyInstaller ETW Patching - ntdll.dll Load from Temp Extraction Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the loading of ntdll.dll by processes executing from common temporary locations (e.g., _MEI* subdirectories used by PyInstaller or .cache/winupdate.exe). Such patterns are frequently associated with the execution of packed or obfuscated malicious payloads, often seen in droppers and loaders that unpack their contents to temporary paths before execution.