RoguePlanet NTFS Junction Swap: Fake System32 Under TEMP\RP_ Staging
This rule detects activities indicative of the RoguePlanet exploit, which utilizes NTFS junction swapping to stage malicious operations. It monitors for the creation of suspicious system-like directories within temporary paths, writing of executables (like wermgr.exe) to those paths, unprivileged manipulation of the Windows Defender Quarantine directory, and virtual disk image mounting from user-writable directories.
Microsoft Sentinel (KQL)
