Windows File Creation: TieringEngineService.exe in RS- Prefixed %TEMP% Directory

title: "Windows File Creation: TieringEngineService.exe in RS- Prefixed %TEMP% Directory"
id: 7e264554-d191-430b-b6ee-56cb47108dfe
status: experimental
description: This rule flags file creation events where TieringEngineService.exe is created in a path containing the RS-{ GUID } prefix under a temporary directory (matching %TEMP%\RS-{...}\TieringEngineService.exe). The behavior is important because staging executables in temp locations with a distinctive RS-prefixed structure can indicate attacker preparation for execution. It relies on Windows file event telemetry that includes the target filename/path so the rule can match both the temp directory segment and the specific RS-{ prefix plus executable name.
references:
  - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
  - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost, Huntrule Team
date: 2026-04-17
tags:
  - attack.stealth
  - attack.t1036.005
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \Temp
      - \RS-{
    TargetFilename|endswith: \TieringEngineService.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
regression_tests_path: regression_data/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators/info.yml
license: DRL-1.1
related:
  - id: f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
    type: derived