RoguePlanet Poseidon I/O Saturation Threads Targeting MsMpEng.exe TOCTOU

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous, high-volume file creation patterns in temp directories characterized by UUID-style filenames from non-system processes. This behavior is indicative of a multi-threaded I/O saturation technique used by the RoguePlanet exploit to create a race condition (TOCTOU) against Microsoft Defender (MsMpEng.exe).