Summary

BlueHammer is a publicly disclosed zero-day local privilege escalation (LPE) vulnerability affecting Microsoft Windows systems via Microsoft Defender. A working proof-of-concept (PoC) exploit has been released publicly, enabling attackers with low privileges to escalate up to NT AUTHORITY\SYSTEM, effectively gaining full control of the host. This is especially critical as it impacts fully patched systems, has a low barrier to exploitation, and there is no official patch available to mitigate it. Note that this does require local access to the system along with the ability to execute code as a low-privileged user.

Affected Systems and/or Applications

• Microsoft Windows (hosts and servers; servers may only allow escalation to Administrator at this time)
• Microsoft Defender Antivirus, especially its signature update mechanism

Technical Details

BlueHammer exploits weaknesses in the Microsoft Defender signature update workflow, rather than the scanning engine itself. The vulnerability chain combines a Time-of-Check to Time-of-Use (TOCTOU) race condition with path confusion and symbolic link manipulation, allowing attackers to redirect privileged file operations.

The exploit operates by interacting with Defender’s internal RPC interface (IMpService) to trigger the signature update process. It uses legitimate update behavior by downloading signature files (such as mpasbase.vdm) from Microsoft servers, then uses opportunistic locking (oplocks) to pause execution at a critical moment. During this race window, the attacker replaces expected file paths using NTFS junctions, reparse points, and Object Manager symbolic links, effectively redirecting operations performed by Defender running as SYSTEM. Advanced techniques such as the Windows Cloud Files API and Volume Shadow Copy mechanisms are used to reliably win the race condition. As a result, Defender executes privileged actions on attacker-controlled paths, enabling escalation to SYSTEM-level access.

Impact capabilities include: - SYSTEM-level shell access (hosts) / Administrator-level access (servers) - Credential dumping (e.g., NTLM hashes) - Full system compromise, including persistence and lateral movement

While exploitation requires precise timing and is not fully reliable, it is considered operationally viable and dangerous due to public PoC availability.

Mitigation

No official patch is currently available.

Recommended defensive actions: - Enforce least privilege principles - Restrict local and interactive access - Monitor Defender-related activity and update processes

What the Cyber Fusion Center is Doing

The Cyber Fusion Center (CFC) is watching the situation and will issue advisories as needed.

References

• https://www.exploitpack.com/blogs/news/blue-hammer-analysis-ms-defender-lpe
• https://cybersecuritynews.com/bluehammer-poc-for-windows-defender/
• https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/

‍