Detects RedSun hacktool used for privilege escalation through Microsoft Defender.

Hunt Hypothesis

This detection targets adversaries leveraging the RedSun hacktool to execute privilege escalation attacks via Microsoft Defender, a tactic often employed by advanced persistent threats to gain elevated system access. SOC teams should proactively hunt for this behavior in Azure Sentinel because early identification of such tool usage allows for immediate containment before attackers can establish persistence or move laterally across critical infrastructure.

YARA Rule

rule HKTL_RedSun_Privilege_Escalation_Apr26 {
   meta:
      description = "Detects RedSun hacktool used for privilege escalation through Microsoft Defender."
      author = "Jonathan Peters (cod3nym)"
      date = "2026-04-16"
      reference = "https://github.com/Nightmare-Eclipse/RedSun"
      hash = "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120"
      score = 80
      id = "64f86635-cf8c-5c65-b821-2d12e8ee9cdb"
   strings:
      $x1 = "\\??\\pipe\\REDSUN" wide
      $x2 = "The red sun shall prevail.\n" ascii fullword
      $x3 = "\\RedSun.pdb" ascii

      $s1 = "\\System32\\TieringEngineService.exe" wide
      $s2 = "SERIOUSLYMSFT" wide
      $s3 = "*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X" ascii
   condition:
      uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or 2 of ($s*)
      )
      or 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “RedSun Hacktool Privilege Escalation” detection rule, including suggested filters and exclusions:

Scenario: Scheduled Maintenance by System Center Configuration Manager (SCCM)
- Context: SCCM often deploys RedSun-compatible agents or uses similar binary paths to push updates and perform system health checks. During these scheduled maintenance windows (e.g., nightly at 02:00), the agent may trigger a privilege escalation event that mimics the RedSun signature while running under the SYSTEM account.
- Filter/Exclusion: Exclude alerts where the Process Name is ccmexec.exe or wuauserv.exe AND the Account Name is NT AUTHORITY\SYSTEM. Additionally, filter out events occurring during defined maintenance windows (e.g., 01:00–04:00 local time).
Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager
- Context: When administrators push critical security patches using the “Microsoft Update” service or custom PowerShell scripts, the system often invokes a temporary elevation mechanism that utilizes RedSun-like binaries. This is common when installing .NET updates or Windows Defender definition updates which require elevated privileges to modify registry keys in HKLM.
- Filter/Exclusion: Create an exclusion for process paths containing \Program Files\Microsoft Endpoint Manager\ where the Parent Process is msiexec.exe or powershell.exe. Filter specifically for events where the Command Line contains keywords like “Update”, “Patch”, or “Definition”.
Scenario: Third-Party Antivirus or EDR Agent Updates (e.g., CrowdStrike, SentinelOne)
- Context: Many enterprise EDR solutions utilize RedSun-compatible components to manage their own sensor updates. When the agent performs a