RoguePlanet Poseidon I/O Saturation Threads - TOCTOU Race Widening

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•21

Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.