id: a86306af-137b-427f-9e39-680199937bd0
description: N/A
date: 2026-04-17
author: Swachchhanda Shrawan Poudel (Nextron Systems)
rule_metadata:
    - id: f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
      title: RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir
regression_tests_info:
    - name: Positive Detection Test
      type: evtx
      provider: Microsoft-Windows-Sysmon
      match_count: 1
      path: regression_data/rules-emerging-threats/2026/Exploits/RedSun/file_event_win_exploit_redsun_indicators/f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d.evtx
