RoguePlanet NTFS Junction Swap: RP_UUID\System32 Reparse Point Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

Detects malicious activity related to the 'RoguePlanet' exploit (referencing CVE-2026-50656) which involves manipulating NTFS junctions to redirect system file operations. The rule monitors for specific staging directory patterns (RP_<UUID>), the creation of named pipes associated with RoguePlanet, and the execution of suspicious binaries or staging of files in system paths.