Possible RedSun Exploit – SYSTEM Execution via TieringEngineService.exe
This detection identifies behavior associated with the RedSun Microsoft Defender local privilege escalation (LPE) exploit. The rule monitors for unauthorized modification of the Windows system binary TieringEngineService.exe or for process execution initiated by this binary running as SYSTEM. RedSun exploits a flaw in Microsoft Defender’s handling of cloud‑tagged files to overwrite this trusted SYSTEM‑level executable and then execute attacker‑controlled code with full SYSTEM privileges. This activity is extremely rare during normal operations and strongly indicates a successful local privilege escalation and full system compromise.
Microsoft Sentinel (KQL)
