detection.wiki

Detection rules › Sigma

RedSun - Named Pipe Created

Status
experimental
Severity
critical
Log source
product windows, category pipe_created
Author
Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
Source
github.com/SigmaHQ/sigma

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1055 Process Injection
StealthT1055 Process Injection
Defense ImpairmentT1685 Disable or Modify Tools

Event coverage

ProviderEventTitle
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)

Rule body yaml

title: RedSun - Named Pipe Created
id: 9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b
status: experimental
description: |
    Detects the creation of a named pipe with the hardcoded name "REDSUN".
    The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain.
    RedSun creates the pipe as \\??\pipe\REDSUN.
    The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM.
    Presence of this pipe name indicates active or recent RedSun execution.
references:
    - https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591
    - https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html
author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
date: 2026-04-17
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.defense-impairment
    - attack.t1055
    - attack.t1685
    - detection.emerging-threats
logsource:
    category: pipe_created
    product: windows
detection:
    selection:
        PipeName: '\REDSUN'
    condition: selection
falsepositives:
    - Unlikely
level: critical
regression_tests_path: regression_data/rules-emerging-threats/2026/Exploits/RedSun/pipe_created_win_exploit_redsun_named_pipe/info.yml

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    PipeName: '\REDSUN'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
PipeNameeq
  • \REDSUN