Suspicious pool.db access followed by in-memory CLR load

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•3

This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.