SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26

rule SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26 : FILE
{
	meta:
		description = "Detects RedSun hacktool used for privilege escalation through Microsoft Defender."
		author = "Jonathan Peters (cod3nym)"
		id = "64f86635-cf8c-5c65-b821-2d12e8ee9cdb"
		date = "2026-04-16"
		modified = "2026-05-15"
		reference = "https://github.com/Nightmare-Eclipse/RedSun"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_redsun_apr26.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120"
		logic_hash = "fb756b0ec61e141fecaf8fc795d10818f4016955dda68772310f8249282f2438"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "\\??\\pipe\\REDSUN" wide
		$x2 = "The red sun shall prevail.\n" ascii fullword
		$x3 = "\\RedSun.pdb" ascii
		$s1 = "\\System32\\TieringEngineService.exe" wide
		$s2 = "SERIOUSLYMSFT" wide
		$s3 = "*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 2 of ( $s* ) ) or 3 of them
}