RoguePlanet Named Pipe Creation or Connection (CVE-2026-50656 LPE Staging)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•29

Detects the creation or connection of a named pipe with a name containing 'RoguePlanet'. Named pipes are a common inter-process communication mechanism that may be abused by malicious software for command and control, lateral movement, or execution, and identifying specific naming conventions associated with known threats is a common detection strategy.