RoguePlanet RP_UUID Staging Directory Creation Under %TEMP%

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the creation of files within temporary directories that follow a specific pattern (RP_ followed by a hex-string), often associated with malware staging activities. It specifically looks for files staged in subdirectories mimicking System32 or wdtest_temp. The rule assigns a risk score based on the types of files staged, identifying potential malicious activity during the preparation phase of an attack.