RedSun.exe exploits a zero-day vulnerability in Microsoft Defender's remediation logic for cloud-tagged malicious files on Windows. By leveraging filesystem primitives, it redirects high-privilege file operations to overwrite protected system directories like C:\Windows\System32 with attacker-controlled binaries. This enables local privilege escalation from standard user to SYSTEM-level access without requiring administrator privileges or kernel exploits. The exploit is publicly available, reliable, and actively weaponized, posing a significant threat for post-exploitation activities such as persistence and lateral movement. No patch or official remediation guidance is currently provided, and the exploit is not known to be widely used in the wild yet.

Successful exploitation allows an attacker with standard user privileges to escalate to SYSTEM-level access on Windows systems. This grants full control over the affected system, enabling arbitrary code execution with the highest privileges. The vulnerability affects Microsoft Defender's remediation process and can be used to overwrite critical system files, facilitating persistence and evasion of defenses. The exploit is reliable and actively weaponized, increasing the risk of compromise in unpatched environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should enforce least privilege principles to limit user permissions. Deploy behavior-based detection mechanisms focused on suspicious Microsoft Defender file operations and privilege escalation attempts. Monitor for filesystem manipulation activities targeting protected system locations. Prepare for rapid patching once vendor updates are released.