{
  "Event": {
    "analysis": "1",
    "date": "2026-04-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Zero-Day Local Privilege Escalation Exploit",
    "protected": false,
    "publish_timestamp": "1776783244",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1776783243",
    "uuid": "42c386fd-5847-4fa1-9d6d-7010860db2ec",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#9c8729",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"",
        "relationship_type": ""
      },
      {
        "colour": "#e76389",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hide Artifacts - T1564\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#f5a258",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Permissions Modification - T1222\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dfeaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#b24806",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#ad5a96",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#d82db7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"",
        "relationship_type": ""
      },
      {
        "colour": "#fda248",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Services - T1569\"",
        "relationship_type": ""
      },
      {
        "colour": "#fdd85e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#150052",
        "local": false,
        "name": "rectifyq:sub-category=\"zero-day\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#7f009f",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"WinNT\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776769221",
        "to_ids": false,
        "type": "text",
        "uuid": "8342e070-d1b3-41ec-afc3-0077db514de0",
        "value": "RedSun.exe is a publicly available proof-of-concept exploit targeting a zero-day vulnerability in Microsoft Defender that enables local privilege escalation from standard user to SYSTEM-level access on Windows systems. The exploit leverages flawed Defender remediation logic for cloud-tagged malicious files, combined with filesystem primitives to redirect high-privilege file operations. This allows attackers to overwrite protected system locations such as %WINDIR%\\System32 with malicious binaries, achieving arbitrary code execution as SYSTEM without requiring administrator privileges or kernel exploits. The technique is reliable, actively weaponized, and potentially unpatched in some environments, making it a critical post-exploitation tool for persistence, lateral movement, and defense evasion. Organizations should implement rapid patching, enforce least privilege principles, and deploy behavior-based detection for suspicious Defender-related file operations and privilege escalation attempts."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776769221",
        "to_ids": false,
        "type": "text",
        "uuid": "d2dfb7bc-06e1-4cf8-8b71-718067836551",
        "value": "Name: Zero-Day Local Privilege Escalation Exploit\nAuthor: AlienVault\nAdversary: \nTags: [\"redsun\", \"redsun.exe\", \"microsoft defender\", \"windows\", \"zero-day\", \"system access\", \"privilege escalation\", \"tieringengineservice\", \"filesystem manipulation\"]\nTgtd countries: []\nMlwr families: [\"RedSun.exe\"]\nAttack_ids: [\"T1543\", \"T1564\", \"T1082\", \"T1106\", \"T1036\", \"T1055\", \"T1222\", \"T1548\", \"T1087\", \"T1059\", \"T1070\", \"T1083\", \"T1574\", \"T1068\", \"T1012\", \"T1569\", \"T1134\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776771229",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "39dd2e32-9252-465c-a963-5bb9293454d6",
        "value": "CVE-2026-33825"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1776776730",
        "uuid": "3a136d63-d8f6-49a2-8d42-a6c7a0e650ce",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1776776730",
            "to_ids": true,
            "type": "md5",
            "uuid": "aab1a048-7726-4f3d-babc-987bdef79fc0",
            "value": "7933bb74a2b3289e8c4b74a43c2149ac",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1776773652",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ae9be13d-18da-4357-a58d-22ac34839a5a",
            "value": "f0f0c5a3421f4d00b9da1387ff9d3cc12332b559",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1776773652",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a42fec66-4634-43cf-8128-ceec54650496",
            "value": "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1776773389",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "1239dba1-5f96-45ea-84d8-186624c6bd6f",
            "value": "3072:5rLBElpScacLL/P+UgK/Y3x9LDEJchOWzS8qZ:5nBElEDcLLGKgvSTZ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1776773389",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "176972b2-1f4a-429e-906b-9525385849ea",
            "value": "156160"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1776773389",
            "to_ids": true,
            "type": "vhash",
            "uuid": "a330ae23-c5ef-478d-a25f-265d6e50eb35",
            "value": "015076655d155d05555068z623z31z5dz1fz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1776773389",
            "to_ids": true,
            "type": "filename",
            "uuid": "cfa3d3de-2f71-4eaf-8231-468ecef9a303",
            "value": "98c30c8a-37eb-4b08-aafa-ba43efa120c6"
          },
          {
            "category": "Other",
            "comment": "Checked: 21/04/2026\nLast-scan\t:  21/04/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1776773389",
            "to_ids": false,
            "type": "text",
            "uuid": "94e4f8aa-119c-4135-a309-0165546106aa",
            "value": "Type Description: Win32 EXE\nMicrosoft: Exploit:Win32/DfndrPERedSun.BB\nVT Total Detection:47/72\nFirst Submission:2026-04-16T01:40:40.000000+00:00\nLast Submission:2026-04-21T08:41:39.000000+00:00"
          }
        ]
      }
    ]
  }
}