RoguePlanet VSS wermgr.exe Oplock and :WDFOO ADS Creation (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.