RoguePlanet EICAR ADS :WDFOO Written to RP_* Temp Dir (CVE-2026-50656)
This rule detects the creation of suspicious NTFS Alternate Data Streams (ADS) commonly associated with malicious activities. Specifically, it monitors for the use of the ':WDFOO' stream name within temporary directories, which is a known indicator of certain malware or post-exploitation staging behaviors. Additionally, it identifies attempts by 'wermgr.exe' (Windows Error Reporting Manager) to interact with temporary files in these paths, which may suggest masquerading or living-off-the-land techniques.
Cortex XDR
