Threats Tagged 'filesystem manipulation'

RedSun. exe is a publicly available proof-of-concept exploit targeting a zero-day vulnerability in Microsoft Defender on Windows systems. It enables local privilege escalation from a standard user to SYSTEM-level access by exploiting flawed Defender remediation logic for cloud-tagged malicious files and redirecting high-privilege file operations to overwrite protected system locations such as C:\Windows\System32. This allows arbitrary code execution as SYSTEM without needing administrator privileges or kernel exploits. The exploit is reliable, actively weaponized, and potentially unpatched in some environments, posing a significant risk for persistence, lateral movement, and defense evasion. No official patch or remediation guidance is currently available. Organizations should enforce least privilege principles and deploy behavior-based detection focused on suspicious Defender-related file operations and privilege escalation attempts. Monitoring for filesystem manipulation targeting protected system directories is also recommended. Rapid patching should be applied once vendor updates are released.