Rogue Planet LPE Activity (FULL Indicator Hunting)
This rule detects potential Local Privilege Escalation (LPE) activity related to a threat dubbed 'Rogue Planet'. It monitors for the creation of temporary files in the local AppData directory with a 'RP_' prefix and the usage of a specific named pipe named 'RoguePlanet'. The rule further isolates suspicious behavior by identifying processes that are not the standard Windows Error Reporting Manager (wermgr.exe) executing from its legitimate path.
Sigma
