RoguePlanet Poseidon I/O Thread Saturation in %TEMP%\RP_* Directories
This rule detects high-frequency file creation events where files are named with potential UUIDs within subdirectories of the 'Temp' folder matching the 'RP_' pattern. This activity is indicative of automated staging or data manipulation by a user-mode process, filtering out activity from system-level accounts.
Splunk (SPL)
