RedSun Sync Root Provider Name (CVE-2026-33825)

Thiru N@Iamthiru

•updated Apr 20, 2026•16•1•2,217

Detects the creation of a Cloud Files API sync root with the specific provider name 'SERIOUSLYMSFT' used by the RedSun LPE exploit to abuse Windows Defender's cloud file rollback mechanism. This rule looks for the specific string 'SERIOUSLYMSFT' in registry value updates (RegValueUpdate) or in command-line arguments of executed processes (ProcessRollup2).