Suspicious TieringEngine COM Instantiation

nomit vyas@xoxo

•updated Apr 20, 2026•16•0•2,280

This rule detects the instantiation of the TieringEngine COM object, identified by the GUID '50d185b9-fff3-4656-92c7-e4018da4361d', via process creation events. This activity is associated with CVE-2026-33825, a zero-day vulnerability that could be exploited by malware like RedSun. The rule specifically looks for this GUID in the command line of newly created processes.