RedSun - Named Pipe Created

Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

2026-04-17 00:00:00

None

9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b

attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1055 attack.t1685 detection.emerging-threats

Community Rule

Nasreddine Bencherchali

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29

Swachchhanda Shrawan Poudel

Merge PR #5941 from @swachchhanda000 - Add RedSun Execution Indicators

2026-04-28