RoguePlanet Exploit Rules

rules-emerging-threats/2026/Exploits/RoguePlanet/file_event_win_exploit_rogueplanet_indicators.yml

@@ -0,0 +1,35 @@
+title: RoguePlanet - Wermgr.exe Staged in RP_ Prefixed Temp Dir
+id: f9d0c0e6-95ec-4998-aef0-944f96884720
+status: experimental
+description: |
+    Detects the creation of a file named wermgr.exe within a directory whose path contains the RP_ prefix,
+    a pattern consistent with RoguePlanet's staging directory
+    (\AppData\Local\Temp\RP_GUID\wdtest_temp\wermgr.exe or \AppData\Local\Temp\RP_GUID\System32\wermgr.exe).
+    The presence of these directory structures, particularly when combined with wermgr.exe,
+    is a strong indicator of RoguePlanet exploitation or exploit testing activity.
+author: Stamatis Chatzimangou (@_st0pp3r_)
+references:
+    - https://raw.githubusercontent.com/MSNightmare/RoguePlanet/refs/heads/main/RoguePlanet.cpp
+    - https://github.com/MSNightmare/RoguePlanet/tree/main
+    - https://git.projectnightcrawler.dev/Takashi_Nekonome/RoguePlanet
+date: 2026-07-04
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: windows
+detection:
+    selection_file:
+        TargetFilename|contains|all:
+            - '\AppData\Local\Temp\RP_'
+            - '\wermgr.exe'
+    selection_dir:
+        TargetFilename|contains:
+            - '\wdtest_temp\'
+            - '\System32\'
+    condition: selection_file and selection_dir
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Exploits/RoguePlanet/pipe_created_win_exploit_rogueplanet_pipe.yml

@@ -0,0 +1,28 @@
+title: RoguePlanet - Named Pipe Created
+id: 93f46e31-a633-4997-b244-fac1dd5f9c97
+status: experimental
+description: |
+    Detects the creation or use of a named pipe containing the string 'RoguePlanet'.
+    Presence of this pipe name is a strong indication of exploit execution.
+author: Stamatis Chatzimangou (@_st0pp3r_)
+references:
+    - https://raw.githubusercontent.com/MSNightmare/RoguePlanet/refs/heads/main/RoguePlanet.cpp
+    - https://github.com/MSNightmare/RoguePlanet/tree/main
+    - https://git.projectnightcrawler.dev/Takashi_Nekonome/RoguePlanet
+date: 2026-07-04
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - attack.execution
+    - attack.t1559
+    - detection.emerging-threats
+logsource:
+    category: pipe_created
+    product: windows
+detection:
+    selection:
+        PipeName|contains: '\RoguePlanet'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Exploits/RoguePlanet/proc_creation_win_rogueplanet_conhost_via_wermgr.yml

@@ -0,0 +1,35 @@
+title: RoguePlanet - Conhost.exe Spawned by wermgr.exe
+id: 1be95c58-1c1f-43d8-b078-902c374bdcad
+status: experimental
+description: |
+    Detects RoguePlanet-related post-exploitation process chains where 'wermgr.exe' leads to
+    suspicious shell execution through 'conhost.exe'.
+author: Stamatis Chatzimangou (@_st0pp3r_)
+references:
+    - https://raw.githubusercontent.com/MSNightmare/RoguePlanet/refs/heads/main/RoguePlanet.cpp
+    - https://github.com/MSNightmare/RoguePlanet/tree/main
+    - https://git.projectnightcrawler.dev/Takashi_Nekonome/RoguePlanet
+date: 2026-07-04
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - attack.execution
+    - attack.t1059
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: windows
+    definition: 'Requirements: process creation telemetry with parent/grandparent process'
+detection:
+    selection:
+        GrandParentImage|endswith: '\wermgr.exe'
+        ParentImage|endswith: '\conhost.exe'
+        Image|endswith:
+            - '\cmd.exe'
+            - '\powershell_ise.exe'
+            - '\powershell.exe'
+            - '\pwsh.exe'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2026/Exploits/RoguePlanet/win_defender_exploit_rogueplanet_wermgr_detected_as_eicar.yml

@@ -0,0 +1,32 @@
+title: RoguePlanet - Wermgr.exe Detected As EICAR Test File
+id: 8f7ff5c8-1960-47d5-a6d7-fbf811383a85
+status: experimental
+description: |
+    Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging wermgr.exe
+    dropped in a characteristic RP_GUID temporary directory, or the RoguePlanet.exe process itself being present.
+author: Stamatis Chatzimangou (@_st0pp3r_)
+references:
+    - https://raw.githubusercontent.com/MSNightmare/RoguePlanet/refs/heads/main/RoguePlanet.cpp
+    - https://github.com/MSNightmare/RoguePlanet/tree/main
+    - https://git.projectnightcrawler.dev/Takashi_Nekonome/RoguePlanet
+date: 2026-07-04
+tags:
+    - attack.privilege-escalation
+    - attack.t1068
+    - detection.emerging-threats
+logsource:
+    product: windows
+    service: windefend
+detection:
+    selection_eid:
+        EventID: 1119
+        SourceName: 'Real-Time Protection'
+    selection_susp_path:
+        Path|endswith: '\wermgr.exe'
+        ThreatName|endswith: 'EICAR_Test_File'
+    selection_susp_process:
+        ProcessName|endswith: '\RoguePlanet.exe'
+    condition: selection_eid and 1 of selection_susp_*
+falsepositives:
+    - Unlikely
+level: high