What Is RedSun?
RedSun is an unpatched zero-day Local Privilege Escalation (LPE) exploit that abuses a logic flaw in Microsoft Defender’s cloud file handling. When Defender detects a malicious file marked with a cloud tag, instead of quarantining or deleting it, it inexplicably rewrites the file back to its original location a behaviour attackers can weaponise to gain full SYSTEM access.
The attack chain:
An attacker creates a crafted file with an EICAR test string and marks it with a cloud tag via the Cloud Files API.
They then use oplocks to win a race condition, and NTFS directory junctions redirect Defender’s privileged write operation to overwrite protected system files
most commonly C:\Windows\System32\TieringEngineService.exe resulting in full SYSTEM access.
How Elastic Detects RedSun
Elastic Security generates the following alerts when this exploit is executed:
- Malware Detection Alert
Elastic detects the EICAR-based payload used to trigger Defender’s cloud file rewrite behaviour.
2. Unusual Parent-Child Relationship
The exploit spawns processes in an abnormal hierarchy, flagged by Elastic’s process lineage analysis.
3. Potential Masquerading as System32 Executable (BBR)
4. Execution of an Unsigned Service (BBR)
5. Account Discovery Command via SYSTEM Account (following my execution of “whoami” )
Post-exploitation commands such as whoami executed under the SYSTEM account trigger an account discovery alert, indicating hands-on attacker activity.
Why This Matters
RedSun remains unpatched as of April 2026. Unlike BlueHammer (CVE-2026-33825), which Microsoft addressed in April’s Patch Tuesday, RedSun has no available fix, meaning even fully updated Windows 10, Windows 11, and Windows Server systems are at risk.