RoguePlanet Named Pipe Creation or Connection (CVE-2026-50656)
This rule detects the creation of or connection to a specific named pipe '\RoguePlanet' using Windows Sysmon events 17 (Pipe Created) and 18 (Pipe Connected). It further highlights events where the integrity level of the process interacting with the pipe is 'low' or 'medium', which may indicate potential inter-process communication (IPC) abuse, process injection, or malicious persistence mechanisms often used by attackers to mask execution or communicate between processes.
Splunk (SPL)
