RoguePlanet Poseidon Thread I/O Saturation: High-Freq Writes to RP_ Temp Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects high-frequency file creation or modification events within directories matching the 'RP_<UUID>' naming pattern in Windows temporary folders. This behavior is indicative of Poseidon generator/worker threads attempting to cause I/O saturation to exploit Time-of-Check Time-of-Use (TOCTOU) vulnerabilities in security products like Microsoft Defender (MsMpEng.exe).