RoguePlanet: Non-System Process Accessing Defender Quarantine TMP Watch Target

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation of files in the Windows temporary folder (C:\Windows\Temp) matching the naming convention 'TMP' followed by 16 alphanumeric characters. This pattern is commonly used by malicious payloads, scripts, or malware installers to stage temporary files. The rule excludes common trusted Windows system and security processes.