Windows Defender (WinDefend) flags TieringEngineService.exe EICAR test staging by RedSun.exe

title: Windows Defender (WinDefend) flags TieringEngineService.exe EICAR test staging by RedSun.exe
id: 5b9df56f-e5d3-41ff-a7a6-5b8b45bbfb09
status: experimental
description: This rule flags Windows Defender operational event 1119 when Real-Time Protection fails to remediate content related to TieringEngineService.exe. It matches either a characteristic RS-{GUID} temporary path ending in \TieringEngineService.exe with a ThreatName ending in EICAR_Test_File, or the presence of a RedSun.exe process. These signals matter because EICAR-based staging is commonly used to reliably force Defender to scan and act on a file, enabling bypass or timing-based exploitation. The rule relies on Windefend event telemetry (EventID 1119) and the event’s Path/ThreatName and/or process name details.
references:
  - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L605
  - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/RedSun/win_defender_exploit_redsun_tiering_engine_detected_as_eicar.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-17
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1036.005
  - attack.t1685
  - attack.privilege-escalation
  - attack.t1055
  - detection.emerging-threats
logsource:
  product: windows
  service: windefend
detection:
  selection_eid:
    EventID: 1119
    SourceName: Real-Time Protection
  selection_susp_path:
    Path|endswith: \TieringEngineService.exe
    ThreatName|endswith: EICAR_Test_File
  selection_susp_process:
    ProcessName|endswith: \RedSun.exe
  condition: selection_eid and 1 of selection_susp_*
falsepositives:
  - Unlikely
level: critical
regression_tests_path: regression_data/rules-emerging-threats/2026/Exploits/RedSun/win_defender_exploit_redsun_tiering_engine_detected_as_eicar/info.yml
license: DRL-1.1
related:
  - id: a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
    type: derived