RedSun Exploit - TieringEngineService.exe Modification
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
Microsoft Sentinel (KQL)
