RedSun
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under tools.
Search every workspace for RedSun. It matches the name as written, so it can find other things that share it.
The items that name it 2
Public PoC privilege escalation tool exploiting a race condition in Defender's Cloud File detection/remediation and a directory junction TOCTOU swap to overwrite C:\Windows\System32\TieringEngineService.exe and hijack the Storage Tiers Management Engine COM object to gain SYSTEM.
All technologies in this workspace.