RedSun Exploit: TieringEngineService.exe Bait File Creation
Detects the creation of the 'TieringEngineService.exe' bait file within a specific RedSun temporary directory pattern (RS-{GUID}) associated with the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to exploit Windows Defender.
Microsoft Sentinel (KQL)
