RedSun.exe exploits a zero-day vulnerability in Microsoft Defender's remediation logic for cloud-tagged malicious files on Windows. By leveraging filesystem primitives, it redirects high-privilege file operations to overwrite protected system directories like C:\Windows\System32 with attacker-controlled binaries. This enables local privilege escalation from standard user to SYSTEM-level access without requiring administrator privileges or kernel exploits. The exploit is publicly available, reliable, and actively weaponized, but no official patch or vendor advisory has been provided yet.

Successful exploitation grants an attacker with standard user privileges SYSTEM-level access on Windows systems, allowing full control over the affected system. This includes arbitrary code execution with the highest privileges, overwriting critical system files, and enabling persistence, lateral movement, and evasion of defenses. The vulnerability affects Microsoft Defender's remediation process and remains potentially unpatched in some environments. Although actively weaponized, it is not yet known to be widely used in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should enforce least privilege principles to limit user permissions. Deploy behavior-based detection mechanisms focused on suspicious Microsoft Defender file operations and privilege escalation attempts. Monitor for filesystem manipulation activities targeting protected system locations such as C:\Windows\System32. Prepare for rapid patching once vendor updates are released.