RoguePlanet EICAR ADS :WDFOO Creation in RP_ Temp Directory (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•7

This rule detects the creation of files with NTFS Alternate Data Streams (ADS). Adversaries often use ADS to hide malicious payloads or tools within the file metadata of legitimate-looking files to evade static analysis and security monitoring.