RoguePlanet Named Pipe IPC Channel Creation (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•27•0•49

This rule detects the creation of or connection to the hardcoded 'RoguePlanet' named pipe, which is utilized as an IPC synchronization channel by the Nightmare Eclipse Defender exploit. The rule monitors for both pipe creation and connection events via Sysmon and Defender for Endpoint (DeviceEvents) telemetry, flagging potential malicious usage or interactions with security processes.