RoguePlanet NTFS Junction Swap in %TEMP%\RP_ to Hijack Defender Quarantine

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the creation of NTFS reparse points or junctions within temporary directory paths, often used by adversaries to bypass directory access controls or redirect file system operations. The rule identifies file creation activities occurring under paths matching a specific temporary folder pattern (RP_ followed by a hex string) and excludes legitimate system operations like wermgr.exe executions.