CVE-2026-41091 (RedSun) — Microsoft Defender Link-Following Elevation of Privilege

Looks for: MsMpEng.exe as the writing process for a PE in System32/SysWOW64/Program Files. Accomplishes: catches the RedSun link-following write-back — the core exploit outcome.

// HUNT: Defender engine writing a PE into a protected system directory (CVE-2026-41091)
// MITRE: T1574, T1068 | CONF: high  FP: low  COST: low-med
// FP NOTES: Defender writes signatures/platform binaries into its OWN dirs, excluded below
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| ContextBaseFileName=/^MsMpEng\.exe$/i
| TargetFileName=/\\(System32|SysWOW64|Program Files( \(x86\))?)\\/i
| TargetFileName!=/\\(Windows Defender|Microsoft\\Windows Defender|Microsoft\\Windows Security)\\/i
| table([@timestamp, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: MsMpEng.exe as the parent of a shell or scripting host. Accomplishes: catches SYSTEM code execution via the engine — no benign equivalent.

// HUNT: Microsoft Defender engine spawning an interactive shell or script host
// MITRE: T1068, T1059.001/.003, T1548 | CONF: high  FP: low  COST: low
// FP NOTES: Defender legitimately launches MpCmdRun.exe / MsMpEngCP.exe, never interactive shells
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^MsMpEng\.exe$/i
| FileName=/^(cmd|powershell|powershell_ise|pwsh|conhost|cscript|wscript|mshta|rundll32|regsvr32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, AuthenticationId, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: any child of MsMpEng.exe that is not a known Defender helper. FP: Defender helpers (MpCmdRun.exe, NisSrv.exe) — excluded; validate per platform version.

// HUNT: Anomalous child process of the Microsoft Defender engine
// MITRE: T1068, T1574 | CONF: high  FP: low-med  COST: low
// TUNING: exclude the known Defender helper set; alert on anything else parented by MsMpEng.exe
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^MsMpEng\.exe$/i
| FileName!=/^(MpCmdRun|MsMpEngCP|NisSrv|MpDlpService|MsSense|SenseIR|SenseCncProxy|MpDefenderCoreService)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Looks for: a process running as SYSTEM (AuthenticationId 999) whose image sits in a user temp / ProgramData path. FP: SYSTEM-context installers from %TEMP% — pair with Q1/Q2 on same host.

// HUNT: SYSTEM-integrity process launched from a user-writable directory
// MITRE: T1068, T1574, T1059 | CONF: low-med  FP: medium  COST: low-med
// TUNING: correlate to Q1/Q2 hits on same aid; exclude known signed installer/update paths
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| AuthenticationId=999
| ImageFileName=/\\(Users\\[^\\]+\\AppData\\Local\\Temp|ProgramData)\\.+\.(exe|dll|scr)$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

Looks for: resolution of the group's known exploit-hosting / disclosure domains. Investigate-only, perishable infrastructure shared across the actor's CVEs.

// HUNT: DNS resolution of known Nightmare Eclipse infrastructure (family)
// MITRE: T1071 | CONF: high  FP: low  COST: low
// FP NOTES: security researchers / sandboxes intentionally resolving the domains
#event_simpleName=DnsRequest
| DomainName=/(^|\.)projectnightcrawler\.dev$|(^|\.)deadeclipse666\.blogspot\.com$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: processes invoking MpCmdRun.exe with engine/platform rollback or removal flags. Accomplishes: surfaces attempts to revert to a vulnerable MMPE. FP: sanctioned IT maintenance — allow-list.

// HUNT: Defender engine/platform downgrade or removal attempt
// MITRE: T1562.001 | CONF: medium  FP: low  COST: low
// TUNING: allow-list sanctioned maintenance hosts/AIDs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^MpCmdRun\.exe$/i
| CommandLine=/(-RemoveDefinitions|-revertplatform|-ReversePassiveMode|-rollback)/i
| table([@timestamp, ComputerName, UserName, CommandLine, ParentBaseFileName], limit=200)