RedSun PoC Shows SYSTEM Privilege Escalation via Microsoft Defender

Summary

A video explains a RedSun PoC that reportedly exploits Microsoft Defender scan and file-handling behavior to gain SYSTEM access. The presenter says an alert is required and speculates that Microsoft may have issued a signature update.

Key points

• The presenter describes using an EICAR test string to trigger a Defender scan, then exploiting a file-lock race and NTFS junction behavior to overwrite a Defender-used binary and run code as SYSTEM.
• The presenter says they did not create the PoC and cautions that their explanation may be incomplete.
• The demonstrated workflow depends on a Defender alert; the presenter says whitelisting the payload or directory prevents the trigger.
• The presenter speculates that Microsoft may have published a signature update by the time viewers watch, but gives no confirmed patch or version status.
• Sliver, Mythic, and Meterpreter are suggested as hypothetical alternatives to the demo’s conhost/CMD payload; the video does not show them deployed.