Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
9
4
Contributors
8
4
1
Categories
12
5
4
4
3
Platforms
13
Products / Services
10
7
2
MITRE Techniques
11
7
4
4
3
CVEs
71
71
64
58
49
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
Detects symlink or junction point creation by standard users targeting sensitive system directories, a core mechanism of CVE-2026-41091.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value in the RedSun exploit (CVE-2026-41091).
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects the creation or connection to the named pipe '\REDSUN' which is known to be used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This rule monitors both Microsoft Defender for Endpoint events and Sysmon Event IDs 17 and 18 for named pipe activity.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Detects the creation of the 'TieringEngineService.exe' bait file within a specific RedSun temporary directory pattern (RS-{GUID}) associated with the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to exploit Windows Defender.