RoguePlanet EICAR ADS Written to RP_* Temp Directory to Trigger Defender Scan

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.