Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26

Detects RedSun hacktool used for privilege escalation through Microsoft Defender.

Hack toolSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters (cod3nym)
Date
2026-04-16
Modified
2026-05-15
Score / Quality
80 / 85

What this rule detects

Detects RedSun hacktool used for privilege escalation through Microsoft Defender.

Targets: Windows PE.

It defines 6 patterns (6 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
hktl-redsun-privilege-escalation-apr26.yarDetection Rule License 1.1
rule SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26 : FILE
{
	meta:
		description = "Detects RedSun hacktool used for privilege escalation through Microsoft Defender."
		author = "Jonathan Peters (cod3nym)"
		id = "64f86635-cf8c-5c65-b821-2d12e8ee9cdb"
		date = "2026-04-16"
		modified = "2026-05-15"
		reference = "https://github.com/Nightmare-Eclipse/RedSun"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_redsun_apr26.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120"
		logic_hash = "fb756b0ec61e141fecaf8fc795d10818f4016955dda68772310f8249282f2438"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "\\??\\pipe\\REDSUN" wide
		$x2 = "The red sun shall prevail.\n" ascii fullword
		$x3 = "\\RedSun.pdb" ascii
		$s1 = "\\System32\\TieringEngineService.exe" wide
		$s2 = "SERIOUSLYMSFT" wide
		$s3 = "*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 2 of ( $s* ) ) or 3 of them
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$x1text"\\??\\pipe\\REDSUN"wide
$x2text"The red sun shall prevail.\n"ascii fullword
$x3text"\\RedSun.pdb"ascii
$s1text"\\System32\\TieringEngineService.exe"wide
$s2text"SERIOUSLYMSFT"wide
$s3text"*H+H$!ELIF-TSET-SURIVITNA-DRADNATS-RACIE$}7)CC7)^P(45XZP\\4[PA@%P!O5X"ascii

Condition

uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 2 of ( $s* ) ) or 3 of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $x* ) must match.
  • At least 2 patterns in ( $s* ) must match.
  • At least 3 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120

Licence & attribution

Author: Jonathan Peters (cod3nym)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 64f86635-cf8c-5c65-b821-2d12e8ee9cdb

Tags:FILE

Related rules