RoguePlanet CVE-2026-50656 NTFS Junction Swap RP_ Staging Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•9

Detects the creation of specific staging directories prefixed with 'RP_' in user temporary directories, containing 'System32' or 'wdtest_temp' subdirectories. This pattern is characteristic of an NTFS junction swap exploitation technique used to target Windows Defender quarantine artifact placement as part of the CVE-2026-50656 vulnerability.