Listen to this Post
Introduction:
The emergence of the “RedSun” threat actor has highlighted a dangerous technique: modifying executable files directly inside `C:\Windows\System32` to achieve persistence and evade traditional security controls. Using Microsoft Defender for Endpoint and Kusto Query Language (KQL), security analysts can proactively hunt for these subtle file modifications before they lead to full‑scale compromise.
Learning Objectives:
- Write and optimize KQL queries to detect anomalous `.exe` file modifications within the Windows System32 directory.
- Understand how to leverage Microsoft Defender’s `DeviceFileEvents` table for threat hunting and incident triage.
- Implement proactive hunting workflows and automated alerts for RedSun‑like tampering techniques.
You Should Know:
1. Understanding the RedSun TTPs and System32 Modifications
RedSun operators often replace or patch legitimate system binaries (e.g., svchost.exe, lsass.exe) with backdoored versions while preserving original file names and timestamps. This activity appears in telemetry as a “FileModified” action on paths matching c:\windows\system32\.exe. Below is the core KQL query shared by Alex Teixeirα:
search in(DeviceFileEvents) "system32" | where Timestamp > ago(30d) and isnotempty(FileName) | where ActionType == @"FileModified" | where FolderPath matches regex @"(?i)c:\windows\system32\[^\]+.exe$" | summarize DevCount=dcount(DeviceId) by FolderPath=tolower(FolderPath), InitiatingProcessParentFileName, InitiatingProcessFileName | sort by DevCount
Step‑by‑step explanation:
– `search in(DeviceFileEvents) “system32″` – quickly filters events containing “system32” to reduce noise.
– `where Timestamp > ago(30d)` – limits scope to the last 30 days.
– `ActionType == “FileModified”` – focuses on modifications, not reads or deletes.
– `matches regex` – ensures only direct children of `system32` with `.exe` extension.
– `summarize dcount(DeviceId)` – counts unique devices per modified file and parent process.
– `sort by DevCount` – surfaces the most widely observed (suspicious) modifications first.
2. Setting Up KQL Hunting Queries in Defender
To run the above query in your environment:
- Step 1: Log into Microsoft 365 Defender portal (security.microsoft.com).
- Step 2: Navigate to Hunting → Advanced hunting.
- Step 3: Paste the KQL query into the editor.
- Step 4: Click Run query and inspect results – high `DevCount` values for unexpected processes like
powershell.exe,wscript.exe, or `rundll32.exe` are red flags. - Step 5: Expand the query to include `InitiatingProcessCommandLine` for deeper context:
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
- Step 6: Create a detection rule by clicking New alert rule → name it “RedSun System32 Tampering” → set severity to Medium/High.
3. Enabling Advanced Audit Policies for File Modifications
If you lack Defender for Endpoint, enable native Windows auditing to generate similar telemetry:
Windows PowerShell (Admin):
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Configure SACL for System32 (using `icacls`):
icacls C:\Windows\System32 /grant SYSTEM:(OI)(CI)(WA) icacls C:\Windows\System32 /setintegritylevel high
Collect events with Get-WinEvent:
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4663} | Where-Object {$<em>.Message -like 'system32.exe' -and $</em>.Message -like 'WriteData'}
These commands help replicate KQL hunting in air‑gapped or legacy environments.
4. Cross‑Platform Hunting: Linux Sysmon vs Windows Defender
For Linux endpoints that may also be targeted by RedSun variants (e.g., modifying `/usr/bin/` or /sbin/), use Sysmon for Linux or auditd:
Install auditd (Ubuntu/Debian):
sudo apt install auditd -y
Add a watch on `/usr/bin/`:
sudo auditctl -w /usr/bin/ -p wa -k redsun_hunt
Search modifications with `ausearch`:
sudo ausearch -k redsun_hunt -ts recent
Equivalent KQL for Linux (using MDE for Linux):
DeviceFileEvents | where FolderPath startswith "/usr/bin/" and ActionType == "FileModified" | project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName
This cross‑platform approach ensures consistent coverage.
5. Automating Threat Hunting with Scheduled KQL Queries
Convert your KQL hunt into a continuous monitoring rule:
– Step 1: In Microsoft 365 Defender, go to Hunting → Custom detection rules.
– Step 2: Click Create detection rule.
– Step 3: Paste the RedSun query and set Run every 24 hours.
– Step 4: Define alert mapping – map `FolderPath` to Alert title, `InitiatingProcessFileName` to Description.
– Step 5: Set action – create incident, send email, or trigger Logic App.
– Step 6: Test the rule by simulating a file modification (e.g., `echo test > C:\Windows\System32\test.exe` – delete after test).
Automation reduces mean time to detect (MTTD) for RedSun‑like activities.
6. Mitigation and Hardening Against System32 Tampering
Prevent modifications before they happen:
Enable Windows Defender Credential Guard and Tamper Protection:
Set-MpPreference -EnableTamperProtection $true
Restrict write access to System32 for non‑administrators:
icacls C:\Windows\System32 /remove "Users" icacls C:\Windows\System32 /deny "Authenticated Users":(WD,AD)
Deploy AppLocker rules to block execution from temp directories and scripts:
<AppLocker> <Exe RuleCollection> <FilePathRule Action="Deny" User="Everyone" Path="%WINDIR%\System32\" /> </Exe> </AppLocker>
Monitor process parent‑child relationships – any process not `wininit.exe` or `services.exe` modifying System32 should trigger an alert.
7. Incident Response Steps When RedSun is Detected
If the KQL hunt returns positive matches:
- Step 1 – Isolate the device: Run `Invoke-MDEActionIsolate -DeviceId
` in Defender or use GUI. - Step 2 – Collect forensic artifacts:
wevtutil epl Security C:\Security.evtx copy C:\Windows\System32\<suspicious>.exe C:\forensics\
- Step 3 – Capture memory and process listing:
Get-Process | Export-Csv C:\forensics\processes.csv .\DumpIt.exe (from https://www.comae.com)
- Step 4 – Compare modified binary against known‑good hash:
certutil -hashfile C:\Windows\System32\svchost.exe SHA256
- Step 5 – Reset all credentials on the affected host and reinstall from a clean image.
- Step 6 – Extend hunting to look for lateral movement (use `DeviceNetworkEvents` with same initiating process).
What Undercode Say:
- Proactive hunting is non‑negotiable. RedSun’s System32 modification technique bypasses signature‑based AV; only behavioral queries in KQL or similar can catch it.
- Parent‑process analysis is the key. Legitimate system updates come from
TrustedInstaller.exe; any other parent (e.g.,powershell.exe) modifying System32 is malicious until proven otherwise. - Defender + KQL is a game changer. The ability to search across millions of events in seconds with regex and summarization makes MDE one of the most powerful threat hunting platforms available.
- Don’t ignore Linux. RedSun may cross over; using auditd or Sysmon provides parity for hybrid environments.
- Automation saves lives. Schedule your KQL hunts as custom detections – waiting for a weekly manual hunt is too slow for today’s adversaries.
Prediction:
In the next 12 months, threat actors like RedSun will increasingly target trusted system directories across both Windows and Linux, leveraging fileless and LOLBin techniques to avoid writes altogether. Consequently, detection will shift from static file modification alerts to anomaly‑based behavioural models – e.g., detecting unexpected process call chains that lead to write operations in protected paths. Organisations that integrate KQL, Sigma rules, and EDR telemetry into a unified data lake will outpace those relying solely on signature updates. The arms race will favour hunters who master query languages and real‑time correlation.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Inode Redsun – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
