RoguePlanet wermgr.exe:WDFOO ADS Creation

nomit vyas@xoxo

•updated Jun 24, 2026•15•0•12

Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.