Red Sun: Exploiting Windows Defender's Quirky Behavior

Red Sun is a vulnerability repository that highlights a peculiar flaw in Windows Defender. Typically, I would share the Proof of Concept (PoC) code and let users explore it themselves, but this case is too amusing to pass up. When Windows Defender identifies a file with a cloud tag as malicious, it bizarrely decides to rewrite the file back to its original location instead of removing it. This PoC cleverly exploits this odd behavior to overwrite system files and escalate privileges to an administrative level. It's ironic how an antimalware tool meant to eliminate threats ends up ensuring their presence instead.