RoguePlanet RP_<UUID> Staging Directory and wermgr.exe Drop in %TEMP%

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects the creation of directories or files within the '\Temp\' directory that match a specific naming pattern ('RP_' followed by an alphanumeric string). This pattern is often associated with the creation of temporary artifacts by scripts, installers, or malicious payloads.