RoguePlanet oplock on wermgr.exe ADS via VSS path to pause Defender
Detects opportunistic lock (oplock) placement on wermgr.exe alternative data streams or volume shadow copy paths. This behavior is associated with the RoguePlanet exploit chain, which attempts to pause the Microsoft Defender service (MsMpEng.exe) by creating a Time-of-Check to Time-of-Use (TOCTOU) race condition during the quarantine process.
Microsoft Sentinel (KQL)
