RoguePlanet: VSS Device Enumeration and wdtest_temp Staging (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•3

This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.