BlueHammer — Windows Defender LPE (CVE-2026-33825)

Overview

Affected Versions

Description

BlueHammer is a local privilege escalation vulnerability in Microsoft Defender Antivirus that chains a TOCTOU race condition with path confusion in Defender’s signature update workflow. A standard user can exploit Defender’s own privileged update mechanism to leak the SAM hive, decrypt credentials, and achieve SYSTEM privileges.

The 7-Stage Attack Chain

1. Wait for Defender Update — Queries Windows Update API for a genuine Defender definition update
2. Download & Extract Update — Downloads real Microsoft-signed update, extracts embedded CAB
3. Trigger Defender + VSS Snapshot — Drops EICAR to force activity, uses oplocks to trigger VSS
4. Call Defender’s Internal RPC — Connects to IMpService endpoint, invokes ServerMpUpdateEngineSignature
5. Redirect via Junctions & Symlinks — Cloud Files placeholders + NTFS junction + Object Manager symlink swap
6. Leak & Parse SAM Hive — Reads SAM from VSS, decrypts boot key, extracts NTLM hashes
7. Weaponize Credentials → SYSTEM — Changes passwords by hash, creates transient service, spawns SYSTEM shell

Key Technical Details

• Cloud Files API abuse: Process-aware filesystem deception — the exploit’s callback only serves crafted placeholders to Defender (identified by PID)
• Oplocks for race control: Batch oplocks freeze Defender at a precise moment for junction/symlink setup
• Real update content: Downloads genuine Microsoft-signed Defender update (not synthetic)
• Full post-exploitation: Doesn’t just dump hashes — changes passwords, creates services, spawns SYSTEM shell, then restores original passwords

Requirements

• Local code execution as a standard user
• Microsoft Defender Antivirus active
• Cloud Files API support (Windows 10 1709+)
• A Defender definition update available
• NOT required: Local admin, disabled tamper protection

Timeline

Detection

Behavioral Indicators (Hunt These, Not Hashes)

SIGMA Rule (Experimental)

title: Potential BlueHammer Exploitation - Defender Update Path Access
status: experimental
description: Detects suspicious access to Windows Defender update paths
logsource:
  category: process_creation
detection:
  selection:
    TargetFilename|contains:
      - '\Windows Defender\Definition Updates\'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: selection
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
  - attack.t1553

Remediation

Immediate (While Unpatched)

1. Restrict local code execution — WDAC/AppLocker allow-listing, block %TEMP% execution
2. Behavioral monitoring — Deploy detection rules above
3. Reduce attack surface — Remove unnecessary local admin, harden browser/document attack surfaces
4. ASR rules — Enable Attack Surface Reduction rules for script/process protection

When Patch Available

1. Push with emergency priority to all Windows endpoints
2. Include Server systems (elevated admin is still critical compromise)
3. Verify patch installation via Defender Vulnerability Management

Note on Tamper Protection

Tamper protection does NOT mitigate BlueHammer. The exploit doesn’t attempt to disable or modify Defender — it uses Defender’s own legitimate update workflow. This is a design-level vulnerability, not a configuration issue.

MITRE ATT&CK Mapping

References

• Original PoC — Nightmare-Eclipse/BlueHammer
• SNEK Reimplementation — atroubledsnake/SNEK_Blue-War-Hammer (67+ stars)
• RedPacket Security — Source-level Analysis
• BleepingComputer — Original Coverage
• WinBuzzer — MSRC Breakdown & Detection Gap
• Ampcus Cyber — Shadow Ops Intel
• Will Dormann confirmation (Tharros) — Mastodon post

Related

• CVE-2026-35616: FortiClient EMS Zero-Day (also unpatched at time of BlueHammer disclosure)
• [[BlueHammer Deep Dive — 7-Stage Technical Analysis]] — Full chain breakdown
• [[BlueHammer Week Two — Status Update]] — Current status and MSRC breakdown

Last updated: April 12, 2026. Tracking until patch is released.