RedSun Exploit Named Pipe Detection

Ethan Andrews@eandrews

•updated Jun 2, 2026•5•0•15

Detects the creation or connection to the named pipe '\REDSUN' which is known to be used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This rule monitors both Microsoft Defender for Endpoint events and Sysmon Event IDs 17 and 18 for named pipe activity.