RoguePlanet: MsMpEng.exe Quarantine Artifact in RP_ Temp Dir (Junction Swap Trigger)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.