System32 TieringEngineService Hijack Detection
Detects the creation, modification, or renaming of the TieringEngineService.exe executable within the System32 directory. This activity is associated with the RedSun exploit (CVE-2026-41091), which leverages Defender remediation redirection to plant a malicious binary. The rule specifically filters out legitimate Windows update operations originating from the WinSxS directory to reduce false positives.
Microsoft Sentinel (KQL)
