RoguePlanet ISO Mount with RP_ Working Dir and CdRom wermgr.exe (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects indicators of the 'RoguePlanet' exploit, which leverages ISO image mounting to stage malicious files. It monitors for the execution of Windows Error Reporting (wermgr.exe) from virtual CD-ROM devices, unauthorized use of PowerShell to mount DiskImages or VHDs, and the creation of specific filesystem paths (RP_<UUID> directories) commonly associated with RoguePlanet exploit activity.