Sigma rule: RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir

Rule

Title

RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir

Status

experimental

Level

critical

Author

Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost

Date

2026-04-17

File

rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains the RS- prefix characteristic
of RedSun's staging directory (e.g. %TEMP%\RS-{GUID}\TieringEngineService.exe).
RedSun registers a Cloud Files sync root under this RS-prefixed path and drops a masqueraded placeholder there as part of its oplock-based AV bypass and privilege escalation chain.

The RS-{GUID} directory name is generated by RedSun itself and has no legitimate system usage,
making the combination of this path prefix and the TieringEngineService.exe filename a highly
specific indicator of RedSun activity.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains|all:
        - '\Temp'
        - '\RS-{'
    TargetFilename|endswith: '\TieringEngineService.exe'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.stealth
• attack.t1036.005
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1036.005

References

• https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
• https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators.yml