RedSun Sync Root Provider Name Registry Modification

nomit vyas@xoxo

•updated Apr 20, 2026•8•0•1,060

Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.