RoguePlanet NTFS Junction Swap: RP_UUID\System32 Staging Under TEMP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects the creation of specific temporary directories following a pattern often used by installers or malware, and the subsequent writing of 'wermgr.exe' (Windows Error Reporting manager) into these temporary locations. This behavior is indicative of potential masquerading or process hijacking attempts, where a malicious executable is disguised as a legitimate Windows process by operating from an unexpected, temporary directory.