Listen to this Post
Introduction
A newly discovered zero-day vulnerability in Microsoft Defender, dubbed “RedSun,” demonstrates a deeply ironic logic flaw: when the antivirus detects a malicious file with a “cloud tag,” it attempts to restore the file to its original location instead of deleting it. This unexpected behavior allows an unprivileged attacker to chain together Windows features—Volume Shadow Copies, opportunistic locks (oplock), NTFS junctions, and the Cloud Files API—to trick Defender into overwriting a protected system binary with SYSTEM-level privileges, achieving full system compromise on fully patched Windows 10, Windows 11, and Windows Server 2019 and later.
Learning Objectives
- Understand the six-stage attack chain of the RedSun exploit and how each Windows component is abused for privilege escalation.
- Learn to detect RedSun activity using PowerShell commands, Sysmon, and KQL queries to monitor for anomalous file writes, oplock usage, and reparse point creations.
- Implement effective mitigation strategies, including Attack Surface Reduction rules, endpoint detection rules, and configuration hardening, until an official patch is released.
You Should Know
- Dissecting the RedSun Attack Chain: From EICAR Bait to SYSTEM Shell
The RedSun exploit is a masterclass in chaining legitimate Windows features into an attack path. The researcher, “Nightmare-Eclipse,” released the PoC on GitHub after a dispute with Microsoft’s Security Response Center, and it has since been observed in the wild. Here is the step-by-step breakdown:
Stage 1: Dropping the EICAR Bait
The exploit creates a bait file named `TieringEngineService.exe` in a temporary directory. It writes the EICAR test string (a harmless 68-character string universally detected as a virus) into this file. To avoid detection at compile time, the string is stored reversed and flipped at runtime.
Stage 2: Triggering Defender’s Remediation
The exploit executes the bait file, triggering Defender’s real-time protection. Defender begins its multi-step remediation process:
– Step A: Creates a Volume Shadow Copy (VSS) snapshot of the disk (e.g., \Device\HarddiskVolumeShadowCopy1).
– Step B: Quarantines or deletes the malicious file.
– Step C: If the file has a “cloud tag,” Defender attempts to restore a clean version from the VSS snapshot back to the original location.
A dedicated `ShadowCopyFinderThread` monitors for new VSS devices. When a new shadow copy appears, the exploit uses a batch oplock (opportunistic lock) to pause Defender’s process at the exact moment it tries to read from the VSS, winning a race condition.
Stage 3: Forging the Cloud Tag
With Defender paused, the exploit performs a POSIX delete (using special flags) to remove the bait file’s name from the directory listing while the file handle remains open. It then writes a new file with the same name, this time registering it with the Cloud Files API (cldapi.dll) to give it a cloud tag.
Stage 4: Fooling Defender
When Defender resumes, it attempts to delete the threat. However, it now sees a file with a “cloud tag.” Instead of deleting it, Defender switches to rollback mode, preparing to restore the file from the VSS snapshot.
Stage 5: NTFS Junction Redirection
As Defender begins the rollback, the batch oplock triggers again. The exploit quickly changes an NTFS junction (a directory redirect) from the temporary folder to C:\Windows\System32. Defender, running with SYSTEM privileges, follows the redirected path without validating it, writing the restored file directly into the protected System32 directory.
Stage 6: Privilege Escalation
The file `TieringEngineService.exe` (a legitimate Windows service binary) lands in System32 with permissive ACLs. The exploit then copies itself into this binary and executes it, gaining full SYSTEM-level privileges.
Detection Commands:
Check for new VSS shadow copies created outside of backup schedules
vssadmin list shadows | findstr /i "HarddiskVolumeShadowCopy"
Monitor for unusual Cloud Files API usage (requires Sysmon config logging cldapi.dll)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=7} | Where-Object {$_.Message -like "cldapi.dll"}
Check for suspicious directory junctions in temp folders
dir /AL /S C:\Users\AppData\Local\Temp\
Query Defender threat detection history for EICAR or TieringEngineService.exe activity
Get-MpThreatDetection | Where-Object {$<em>.Resources -like "TieringEngineService" -or $</em>.ThreatID -eq 2147519003}
- The Cloud Files API: How Attackers Forge the “Cloud Tag”
The Cloud Files API (cldapi.dll) is a legitimate Windows component that allows applications to integrate with cloud storage providers like OneDrive and Dropbox. In the RedSun exploit, the attacker abuses this API to register a fake cloud sync root and create a placeholder file with cloud metadata. This tricks Defender into treating a local malicious file as if it were a cloud-synced file that needs restoration rather than deletion.
How the API is abused:
1. `CfRegisterSyncRoot` registers a fake sync root with a specific provider ID.
2. `CfConnectSyncRoot` establishes a connection to the sync root.
3. `CfCreatePlaceholders` creates a placeholder file that appears to be cloud-managed.
Detection and Hardening:
PowerShell Detection Script:
List all registered sync roots (legitimate and potentially malicious)
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" -Recurse
Monitor for new sync root registrations in Event Logs (Event ID 1 from Source "Cloud Files API")
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-CloudFiles/Operational'; ID=1} |
Where-Object {$_.Message -like "CfRegisterSyncRoot"}
Check for placeholder files in unusual locations (e.g., %TEMP%)
Get-ChildItem -Path C:\Users\AppData\Local\Temp -Recurse -File |
Where-Object { (Get-ItemProperty -Path $_.FullName -Name "cloud" -ErrorAction SilentlyContinue) }
Mitigation:
- Consider restricting execution of `cldapi.dll` via AppLocker or WDAC (Windows Defender Application Control) for non-essential users.
- Enable PowerShell logging to capture suspicious API calls.
- Oplocks and Race Conditions: Winning the VSS Timing War
The RedSun exploit heavily relies on oplock (opportunistic lock) to control the timing of Defender’s remediation process. An oplock is a legitimate Windows file-coordination mechanism that allows a process to be notified when another process attempts to access a file. In this exploit, the attacker sets a batch oplock on the bait file. When Defender tries to read the file from the VSS snapshot, the oplock triggers, giving the attacker a precise window to perform the POSIX delete, write the cloud-tagged file, and change the NTFS junction.
Technical Deep Dive:
– `FILE_OPLOCK_BATCH_ACKNOWLEDGEMENT` is the specific oplock type used.
– The exploit uses `CreateFile` with `FILE_FLAG_OVERLAPPED` and `FILE_OPEN_FOR_BACKUP_INTENT` to request the oplock.
– The race condition exploits the “time-of-check to time-of-use” (TOCTOU) vulnerability in Defender’s file handling.
Detection Commands:
Linux (using inotify to monitor file access patterns, useful for cross-platform analysis)
inotifywait -m -r -e access,modify,open /path/to/watched/directory
Windows (using Sysmon Event ID 7 for image loaded, 11 for file create, and 2 for file creation time change)
Ensure Sysmon is configured with a config that logs oplock events
Example Sysmon config snippet to log oplock usage:
<RuleGroup name="" groupRelation="or">
<FileCreateTime onmatch="exclude"> <!-- Log all file create time changes -->
</FileCreateTime>
</RuleGroup>
PowerShell to monitor for processes using oplocks (requires Sysmon)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=11} |
Where-Object {$_.Message -like "oplock"}
Monitor for VSS snapshot creation by non-backup processes
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Ntfs/Operational'; ID=98} |
Where-Object {$_.Message -like "Volume Shadow Copy"}
- NTFS Junctions and Reparse Points: The Silent Redirect
NTFS junctions (also known as reparse points) are a legitimate Windows feature that allows one directory to silently point to another. No special permissions are required to create them. In the RedSun exploit, the attacker creates a junction from the temporary folder containing the bait file to C:\Windows\System32. Defender, running with SYSTEM privileges, follows this junction without any validation, writing the restored file directly into the protected system directory.
How to detect and prevent:
Detection Commands:
List all junctions and reparse points on the system
dir /AL /S C:\
Find junctions pointing to System32
dir /AL /S C:\Users\ | findstr /i "System32"
PowerShell alternative
Get-ChildItem -Path C:\ -Recurse -Force -ErrorAction SilentlyContinue |
Where-Object { $_.LinkType -eq 'Junction' } |
Select-Object FullName, Target
Monitor for new junction creation (requires Sysmon Event ID 11 with ReparsePoint)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=11} |
Where-Object {$_.Properties[bash].Value -eq "ReparsePoint"}
Mitigation:
- Use Attack Surface Reduction (ASR) rule `Block process creations originating from PSExec and WMI commands` to limit lateral movement.
- Implement Windows Defender Firewall rules to restrict inbound SMB traffic that could be used for remote junction creation.
- Consider using Microsoft Defender for Endpoint with custom detection rules for reparse point creation in user-writable directories.
- BlueHammer and UnDefend: The Other Two Zero-Days in the Wild
The RedSun exploit is part of a trio of zero-days disclosed by the same researcher. Understanding the full landscape is critical:
| Exploit | Type | CVE | Patch Status | Attack Vector |
|||–|–||
| BlueHammer | Local Privilege Escalation | CVE-2026-33825 (CVSS 7.8) | Patched April 14, 2026 | Windows Update Agent COM interface, pending Defender signature update |
| RedSun | Local Privilege Escalation | None yet | Unpatched | Cloud Files API + VSS + NTFS junction |
| UnDefend | Denial of Service | None yet | Unpatched | Blocks Defender definition updates or disables Defender entirely |
Detection for BlueHammer:
Check for suspicious Windows Update Agent activity
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WindowsUpdateClient/Operational'; ID=43} |
Where-Object {$_.Message -like "MpCmdRun"}
Monitor for SAM/SYSTEM hive access from non-system processes
Requires Sysmon Event ID 10 (ProcessAccess) with TargetImage containing "SAM" or "SYSTEM"
Detection for UnDefend:
Check for tampering with Defender signature update registry keys
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Signature Updates"
Monitor for disabling of real-time protection
Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring
Query Event Log for Defender service stop events
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036} |
Where-Object {$_.Message -like "Windows Defender Antivirus Servicestopped"}
6. RedSun in the Wild: Real-World Attacks Observed
Huntress Labs reported observing all three exploits being deployed in active attacks. On April 16, 2026, attackers dropped the RedSun PoC (renamed to FunnyApp.exe) into a user’s Downloads and Pictures folders. Before launching the exploit, they executed enumeration commands typical of hands-on-keyboard activity:
Commands observed:
whoami /priv List current user's privileges cmdkey /list List stored credentials net group "Domain Admins" /domain Enumerate domain admins (if domain-joined) net localgroup administrators List local administrators ipconfig /all Network configuration systeminfo System information
The attacker then executed the RedSun exploit, gaining SYSTEM privileges and potentially deploying further payloads.
Indicators of Compromise (IoCs):
- File hashes of known PoC binaries (check VirusTotal for `RedSun.exe` or
FunnyApp.exe) - Creation of junctions in `%TEMP%` folders pointing to `System32`
– Unexpected `TieringEngineService.exe` modifications (check file hash against known good) - EICAR string appearing in Defender logs (
Get-MpThreatDetection)
- Mitigation and Hardening: Defending Until the Patch Arrives
Microsoft has not yet released a patch for RedSun. Until then, security teams should implement the following measures:
Endpoint Detection Rules (EDR/KQL):
// Hunt for Cloud Files API usage by non-standard processes DeviceProcessEvents | where ProcessCommandLine contains "cldapi.dll" or FileName contains "cldapi" | where InitiatingProcessAccountName != "SYSTEM" and InitiatingProcessAccountName != "NT AUTHORITY\SYSTEM" // Detect oplock-assisted file redirection DeviceFileEvents | where FolderPath contains "\System32\" and FolderPath contains "\Temp\" | where Timestamp > ago(1d) // Monitor for new junction/reparse point creation in user-writable areas DeviceFileEvents | where ActionType == "FileCreated" and FileAttributes contains "ReparsePoint" | where FolderPath startswith "C:\Users\"
System Hardening:
1. Enable Attack Surface Reduction (ASR) rules:
- Rule ID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` (Block all executable files from running unless they meet a prevalence, age, or trusted list criteria)
- Rule ID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` (Block executable files from running unless they are in a trusted list)
2. Restrict Cloud Files API usage:
Disable Cloud Files API for non-admin users (requires Group Policy) Set registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudFiles\DisableCloudFilesAPI = 1
3. Limit VSS snapshot creation:
Reduce VSS storage space to limit snapshot retention vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1GB
4. Enable PowerShell logging:
Enable Script Block Logging and Module Logging Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
5. Use Windows Defender Application Control (WDAC):
- Create a base policy that only allows trusted Microsoft binaries and your organization’s approved applications.
- Block execution from `%TEMP%` and user-writable directories.
Emergency Response:
If you suspect RedSun exploitation, immediately isolate the affected system, collect forensic artifacts (MFT, USN journal, Event Logs), and reset all credentials used on the compromised machine.
What Undercode Say
- Antivirus as an Attack Vector: The RedSun exploit represents a paradigm shift in privilege escalation: the security tool itself becomes the attack vehicle. This highlights the danger of overly complex remediation logic and the principle of least astonishment.
- Patch Tuesday Is Not Enough: The researcher’s decision to publicly disclose three zero-days in protest of Microsoft’s handling of the disclosure process underscores a systemic issue in coordinated vulnerability disclosure. Until vendors treat security researchers as partners rather than adversaries, public disclosures will continue to occur.
- Defense in Depth Is Critical: While Microsoft works on a patch, security teams must rely on detection and mitigation. Proactive hunting for the IoCs listed above, combined with ASR rules and application control, can stop RedSun even without a signature update.
Prediction
The RedSun exploit will likely be incorporated into commodity malware kits within the next 30 days, leading to widespread exploitation in phishing campaigns and drive-by downloads. Microsoft may be forced to release an out-of-band emergency patch, but the underlying architectural flaw—Defender’s trust in user-controlled path redirections—may require a more fundamental redesign. Expect to see similar cloud-tag abuse vulnerabilities emerge in other EDR solutions that rely on similar remediation logic. Organizations should prioritize migrating to EDR solutions with stronger path validation and consider deploying additional layers of endpoint protection until Microsoft addresses this class of vulnerabilities systemically.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Shreyash Tambe – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
