RoguePlanet ISO Mount with RP_ Temp Directory and System32 Junction Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.