RedSun Named Pipe Creation Detection

nomit vyas@xoxo

•updated Apr 20, 2026•29•0•1,423

This rule detects the creation or connection to a named pipe with the specific name 'REDSUN'. This activity is associated with the RedSun PoC (Proof of Concept) for CVE-2026-33825, a zero-day vulnerability in Windows Defender. The rule looks for events indicating named pipe creation or connection across various security event sources, including Falcon native events and Sysmon events (Event IDs 17 and 18).