RedSun Proof‑of‑Concept Abuses Microsoft Defender File Handling Behaviour

Du'aine Davis

Observed in the wild

• A publicly available GitHub repository, RedSun, demonstrates a proof‑of‑concept issue affecting how Microsoft Defender handles cloud‑flagged malicious files. Under certain conditions, Defender may rewrite a detected file back to its original location, creating a path to overwrite protected system files. Although presented as research, Huntress has reported RedSun being observed alongside other Nightmare Eclipse tooling during intrusions in April.
• RedSun shows a local privilege escalation technique that abuses Defender’s remediation behaviour. By manipulating Defender’s response to cloud‑tagged malware, the technique enables file overwrite scenarios that can result in administrative access. Huntress reporting indicates RedSun has been used during post‑compromise, hands‑on‑keyboard activity, chained with tools such as BlueHammer and UnDefend, rather than for initial access.
• Defenders should watch for abnormal Defender remediation and follow‑on file activity. Key indicators include unexpected file recreation at original paths, Defender detections preceding privilege escalation, and execution of untrusted binaries from user‑writable locations. Enforce Microsoft Defender Tamper Protection, keep Defender platform updates current, and correlate Defender alerts with subsequent system‑level changes.

GitHub - Nightmare-Eclipse/RedSun: The Red Sun vulnerability repository · GitHubHuntress (@HuntressLabs): " use of Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.| XCancel