Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
9
3
2
1
1
Contributors
9
3
1
1
1
Categories
5
5
4
3
2
Platforms
15
Products / Services
11
4
4
4
1
MITRE Techniques
7
6
3
3
3
CVEs
71
71
64
58
49
16
Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Detects vssvc.exe opening a handle to MsMpEng.exe.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
Detects Windows Defender engine (mpengine.dll) or signature database files (*.vdm) being created by any process that is not a Windows Defender component.
BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.
BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.
Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache).
BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user.
The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.
BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user.
The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.
Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.
This rule detects the instantiation of the TieringEngine COM object, identified by the GUID '50d185b9-fff3-4656-92c7-e4018da4361d', via process creation events. This activity is associated with CVE-2026-33825, a zero-day vulnerability that could be exploited by malware like RedSun. The rule specifically looks for this GUID in the command line of newly created processes.
RedSun Detection
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
This rule detects the creation or connection to a named pipe with the specific name 'REDSUN'. This activity is associated with the RedSun PoC (Proof of Concept) for CVE-2026-33825, a zero-day vulnerability in Windows Defender. The rule looks for events indicating named pipe creation or connection across various security event sources, including Falcon native events and Sysmon events (Event IDs 17 and 18).
Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
This rule detects Windows devices running an antivirus platform version that is not '4.18.26030.3011'. This could indicate an outdated antivirus installation, which might be a result of defense evasion tactics or a failure in update mechanisms, leaving the system vulnerable.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
