RoguePlanet: Defender Quarantine Watch via TMP+16char File and RP_ Staging Dir Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the simultaneous creation of specific Windows Defender quarantine artifacts (C:\Windows\Temp\tmp[16 chars]) and RP_ staging directories, which is indicative of the RoguePlanet race condition exploitation technique. This activity involves leveraging ReadDirectoryChangesW to synchronize file operations and bypass security controls.