RoguePlanet Named Pipe Creation (CVE-2026-50656 Exploit Orchestration)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•11

Detects indicators of activity associated with 'RoguePlanet', including specific command-line strings, named pipes, process spawning behaviors related to Microsoft Defender (MsMpEng.exe), and suspicious staging patterns involving 'wermgr.exe' in temporary directories.