Windows File Creation: TieringEngineService.exe in RS- prefixed Temp Directory
Detects creation of TieringEngineService.exe under an RS-{GUID}-prefixed directory in %TEMP% on Windows.
- Product
- windows
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost (SigmaHQ), DRL 1.1
- Published
- 2026-04-17
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation of TieringEngineService.exe within a Windows path that contains the RS-{GUID} staging prefix and a Temp directory segment. Attackers may use staged executables in temporary locations to prepare follow-on execution while blending into common filesystem activity. Telemetry required includes file creation or file event logs with the full target file path, captured as TargetFilename.
Reporting behind it
- github.comhttps://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
- deadeclipse666.blogspot.comhttps://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Creation: TieringEngineService.exe in RS- prefixed Temp Directory"
id: 7e264554-d191-430b-b6ee-56cb47108dfe
status: experimental
description: This rule identifies creation of TieringEngineService.exe within a Windows path that contains the RS-{GUID} staging prefix and a Temp directory segment. Attackers may use staged executables in temporary locations to prepare follow-on execution while blending into common filesystem activity. Telemetry required includes file creation or file event logs with the full target file path, captured as TargetFilename.
references:
- https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
- https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost, Huntrule Team
date: 2026-04-17
tags:
- attack.stealth
- attack.t1036.005
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains|all:
- \Temp
- \RS-{
TargetFilename|endswith: \TieringEngineService.exe
condition: selection
falsepositives:
- Unlikely
level: critical
regression_tests_path: regression_data/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators/info.yml
license: DRL-1.1
related:
- id: f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
type: derived