{"id":9735,"date":"2026-07-02T01:27:04","date_gmt":"2026-07-02T01:27:04","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=9735"},"modified":"2026-07-02T01:29:35","modified_gmt":"2026-07-02T01:29:35","slug":"how-to-detect-rogueplanet-via-defender-xdr-sentinel","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/how-to-detect-rogueplanet-via-defender-xdr-sentinel","title":{"rendered":"How to detect RoguePlanet CVE-2026-50656 via Defender XDR \\ Sentinel"},"content":{"rendered":"\n
let ADS_Signal = DeviceFileEvents\n| where ActionType == \"FileStreamsCreated\" and FileName =~ \"wermgr.exe\"\n| extend StreamName = tostring(parse_json(AdditionalFields).FileStreamName)\n| where isnotempty(StreamName)\n| extend Signal = \"ADS_wermgr\", SignalWeight = 30\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(\"ADS stream=\", StreamName, \" parent=\", InitiatingProcessFileName);\nlet RPDir_Signal = DeviceFileEvents\n| where ActionType in (\"FolderCreated\", \"FileCreated\") and FolderPath contains @\"\\RP_\"\n| extend Signal = \"RP_TempDir\", SignalWeight = 20\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(\"RP_ path=\", FolderPath, \" by=\", InitiatingProcessFileName);\nlet MsMpEng_Signal = DeviceFileEvents\n| where InitiatingProcessFileName =~ \"MsMpEng.exe\" and FolderPath contains @\"\\RP_\"\n| extend Signal = \"MsMpEng_RP_Access\", SignalWeight = 15\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(\"MsMpEng in RP_ path=\", FolderPath);\nlet Pipe_Signal = DeviceEvents\n| where tostring(AdditionalFields) has \"RoguePlanet\"\n| extend Signal = \"NamedPipe_RoguePlanet\", SignalWeight = 40\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(\"pipe event=\", ActionType, \" proc=\", InitiatingProcessFileName);\nlet Wermgr_Signal = DeviceProcessEvents\n| where FileName =~ \"wermgr.exe\"\n| where not (FolderPath startswith @\"C:\\Windows\\System32\\\" or FolderPath startswith @\"C:\\Windows\\SysWOW64\\\")\n| extend Signal = \"Wermgr_Anomaly\", SignalWeight = 25\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(\"wermgr outside System32 path=\", FolderPath, \" parent=\", InitiatingProcessFileName);\nlet IsoMount_Signal = DeviceProcessEvents\n| where (FileName in~ (\"diskpart.exe\", \"mountvol.exe\") or (FileName in~ (\"powershell.exe\", \"pwsh.exe\", \"cmd.exe\") and ProcessCommandLine has_any (\".iso\", \".vhd\", \".vhdx\", \"Mount-DiskImage\", \"attach vdisk\", \"select vdisk\", \"VirtualDisk\")))\n| where ProcessIntegrityLevel in (\"Medium\", \"Low\") and AccountName !endswith \"$\"\n| extend Signal = \"IsoMount_UserContext\", SignalWeight = 20\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(AccountName, \" ran=\", FileName, \" integrity=\", ProcessIntegrityLevel);\nlet PrivEsc_Signal = DeviceProcessEvents\n| where ProcessIntegrityLevel == \"System\"\n| join kind=inner (\n    DeviceProcessEvents\n    | where ProcessIntegrityLevel in (\"Medium\", \"Low\")\n    | where FolderPath contains @\"\\RP_\" or (FileName =~ \"wermgr.exe\" and not (FolderPath startswith @\"C:\\Windows\\System32\\\" or FolderPath startswith @\"C:\\Windows\\SysWOW64\\\"))\n    | project DeviceId, ParentPID = ProcessId, ParentProc = FileName, ParentPath = FolderPath, ParentIntegrity = ProcessIntegrityLevel\n) on DeviceId, $left.InitiatingProcessId == $right.ParentPID\n| extend Signal = \"UserToSystem_PrivEsc\", SignalWeight = 30\n| project Timestamp, ReportId, DeviceId, DeviceName, Signal, SignalWeight, SignalDetail = strcat(ParentProc, \"(\", ParentIntegrity, \") from RP_\/non-System32 path->\", FileName, \"(SYSTEM)\");\nunion ADS_Signal, RPDir_Signal, MsMpEng_Signal, Pipe_Signal, Wermgr_Signal, IsoMount_Signal, PrivEsc_Signal\n| summarize (Timestamp, ReportId) = arg_max(Timestamp, ReportId), Signals = make_set(Signal), SignalCount = dcount(Signal), AllDetails = make_set(SignalDetail) by DeviceId, DeviceName\n| extend TotalScore = case(Signals has \"ADS_wermgr\", 30, 0) + case(Signals has \"RP_TempDir\", 20, 0) + case(Signals has \"MsMpEng_RP_Access\", 15, 0) + case(Signals has \"NamedPipe_RoguePlanet\", 40, 0) + case(Signals has \"Wermgr_Anomaly\", 25, 0) + case(Signals has \"IsoMount_UserContext\", 20, 0) + case(Signals has \"UserToSystem_PrivEsc\", 30, 0)\n| where TotalScore >= 30 or Signals has \"NamedPipe_RoguePlanet\" or Signals has \"ADS_wermgr\"\n| extend AlertSeverity = case(TotalScore >= 80, \"Critical\", TotalScore >= 50, \"High\", TotalScore >= 30, \"Medium\", \"Informational\")\n| extend ThreatName = \"RoguePlanet\"\n| project Timestamp, ReportId, DeviceId, DeviceName, ThreatName, AlertSeverity, TotalScore, SignalCount, Signals, AllDetails\n| sort by TotalScore desc\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9735","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t