RedSun Exploit Named Pipe Creation

Bryant Smith@flowstate

•updated Jun 2, 2026•2•0•10

Detects the creation of the '\REDSUN' named pipe, which is used by the CVE-2026-41091 exploit for inter-process communication. This pipe facilitates the transfer of session ID information between the user-level exploit and the SYSTEM-level payload.