Bypass Record
Exploitation for Priv-Esc × Microsoft Defender
A publicly-reported instance of Exploitation for Priv-Esc bypassing Microsoft Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
RedSun exploits a race condition in Microsoft Defender's real-time scanning remediation path. It chains Volume Shadow Copy, batch oplocks, Cloud Files API placeholders, and NTFS junctions to intercept a privileged file write operation performed by Defender (running as SYSTEM) and redirect it to drop a malicious binary into C:\Windows\System32, which then executes as SYSTEM.
Detection & mitigation
Monitor for unexpected file creation events in C:\Windows\System32 originating from MsMpEng.exe (Defender's service process) using Sysmon Event ID 11 or Windows Security Event 4663 with a SACL on System32. Mitigate by applying vendor patches promptly and restricting write access to System32 to only trusted processes via Windows Defender Application Control or AppLocker.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.