RoguePlanet: Quarantine Artifact Overwrite by Non-SYSTEM Process (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).