After Microsoft fixed BlueHammer, another Windows Defender privesc showed up: RedSun.
What makes this one interesting is that it’s not a classic memory corruption or logic bug. It looks more like Defender doing something… unexpected.
When Defender flags a file as malicious and it has a cloud verdict attached, it can end up writing that file back to its original location instead of removing it. If you can control that file and trigger the right behavior, you basically get Defender to write data for you with its elevated privileges.
The RedSun PoC shows that this can be abused to overwrite system files and escalate privileges to SYSTEM.
We took a closer look at the exploit and built detections. We’re publishing:
- Sigma rules covering different stages of the chain
- a YARA rule for the PoC
All rules are free on GitHub and also included in the free THOR Lite and THOR Lite Cloud scanner.
Sigma rules: https://t.co/w2jtiDzW4f
by @swachchhanda
YARA rule: https://t.co/vBNQkZhele
by @cod3nym
Hunting RedSun 🌞
Inspired by the Nightmare‑Eclipse RedSun PoC, I’ve expanded my BlueHammer KQL detection to uncover Defender’s behavioral blind spots.
Sharing my DefenderXDR hunting logic with the community — evolving the path from BlueHammer to RedSun.🎯
KQL Code: https://t.co/YK5EimNR2a
#CyberSecurity #RedSun #DetectionEngineering #DefenderXDR
@banthisguy9349@UK_Daniel_Card Use JA4+ when it makes sense to do so. Check for reuse of custom favico files from actor infra. Not secret by any means but have borne fruit at times
A single hypervisor breach can put hundreds of virtual machines at risk.
We’ve seen Akira and others shift to ESXi/Hyper-V for mass impact.
✅ They use legit tools (like openssl)
✅ Bypass EDR
✅ Encrypt VMDKs directly
📃 @RussianPanda9xx@Purp1eW0lf
https://t.co/nWxBC2Tb65
Six years ago I wondered how we would enable scanning of end-to-end encrypted messages without destroying security and introducing trusted parties everywhere. Now in 2025, I realize the answer is: we’re going to introduce trusted parties everywhere.
This appears to be a key compromise.
Lydsec creates Keypasco, a MFA handling solution for enterprise and mobile.
The stolen key (not EV, no hardware token) was used to sign CobaltStrike.
Its not known how or who acquired the key, or what other damage was done.
New in Wirebrowser: Breakpoint-Driven Heap Search (BDHS) — step-out debugging + temporal heap snapshots to identify the user-land function where a JavaScript value is created, even across async boundaries.
Writeup: https://t.co/1pQAUX5zlj
LAC's Cyber Emergency Center describes a PlugX campaign by a China-based attack group targeting Japanese transport firms & their subsidiaries. The report analyses new PlugX variants MetaRAT and Talisman PlugX, and expands on findings first shared at VB2025 https://t.co/n5ZxOArZem
I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like.
If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs and what anomalous look might like.
https://t.co/pSSYRFir6O
@APTease IMO, Matt Walsh is a hateful person who resorted to trickery to film “what is a woman”, used to increase oppression on the trans community. Seeing his work get quoted is troubling. I’m thankful for the great yara work that Florian does but can live without this type of comment.
"Offense and defense aren't peers. Defense is offense's child." - @JohnLaTwC
We built an LLM-powered AMSI provider and paired it against a red team agent. Then, @0xdab0 wrote a blog about it: https://t.co/TTehwMdofs
A few observations from the experiment:
>>> To advance, we must generate unique, ground-truth datasets.
>>> Defenses will need to live at the edge.
>>> The real potential lies in the interaction between red and blue.
>>> This is a blueprint for generative adversarial reinforcement learning.