RoguePlanet ISO Mount with RP_ Temp Directory for Defender Junction Abuse

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.