BlueHammer (CVE-2026-33825): Eight-Stage Windows Defender Privilege Escalation Chain — OTX Pulse Analysis & Enterprise Detection Pack

---
title: BlueHammer CVE-2026-33825 — Suspicious Oplock and Symlink Activity Against Defender Paths
id: 7c2a1f4e-9b3d-4e1a-a5c6-2f8d9e0b1a23
status: experimental
description: Detects handle/oplock and object-manager symlink manipulation targeting Windows Defender platform directories, consistent with BlueHammer stages 2-4 (CloudFilter callbacks, batch oplocks, object-manager symlinks)
references:
  - https://blog.qualys.com/product-tech/2026/10/21/bluehammer-cve-2026-33825-windows-defender-privilege-escalation
author: Security Arsenal Threat Intel
date: 2026/10/22
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows Defender\'
      - '\Program Files\Windows Defender\'
      - '\MsMpEng.exe'
      - '\MpSigStub.exe'
  selection_actor:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_target and selection_actor
falsepositives:
  - Legitimate Defender platform updates (MpSigStub execution)
  - Enterprise management tooling touching Defender directories
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1036
---
title: BlueHammer Post-Exploitation — LSASS or SAM Hive Access by Non-System Process
id: 3d8b5c2f-1a7e-4f6b-9c2d-8e4a6b0d3f15
status: experimental
description: Detects suspicious access to LSASS memory or the SAM hive consistent with BlueHammer post-escalation credential theft stages (offline SAM parsing, LSASS credential theft)
references:
  - https://blog.qualys.com/product-tech/2026/10/21/bluehammer-cve-2026-33825-windows-defender-privilege-escalation
author: Security Arsenal Threat Intel
date: 2026/10/22
logsource:
  category: process_access
  product: windows
detection:
  selection_lsass:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_legit:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\svchost.exe'
      - '\wininit.exe'
      - '\csrss.exe'
      - '\services.exe'
  condition: selection_lsass and not filter_legit
falsepositives:
  - Legitimate EDR/AV products accessing LSASS for monitoring
  - System backup and forensic tooling
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.t1003.002
---
title: BlueHammer Post-Exploitation — SAMR Account Enumeration and Pass-the-Hash Artifacts
id: 9e4d7a1b-6c3f-4a2e-b8d5-1f7c3e9a2b48
status: experimental
description: Detects SAMR protocol abuse and anomalous NTLM logon patterns consistent with pass-the-hash lateral movement following BlueHammer SYSTEM escalation
references:
  - https://blog.qualys.com/product-tech/2026/10/21/bluehammer-cve-2026-33825-windows-defender-privilege-escalation
author: Security Arsenal Threat Intel
date: 2026/10/22
logsource:
  product: windows
  service: security
detection:
  selection_samr:
    EventID: 4661
    ObjectServer: 'Security Account Manager'
  selection_ntlm_ptm:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
    LmPackageName: 'NTLMv1'
  condition: 1 of selection_*
timeframe: 15m
falsepositives:
  - Legacy applications forcing NTLMv1 authentication
  - Domain admin tools performing legitimate SAMR queries
level: high
tags:
  - attack.lateral_movement
  - attack.t1550.002
  - attack.t1087

// BlueHammer (CVE-2026-33825) hunt — Defender exploitation + credential theft behaviors
// Hunt 1: Unpatched Defender platform versions in the estate
let VulnerableDefender = DeviceInfo
    | where TimeGenerated > ago(1d)
    | summarize arg_max(TimeGenerated, *) by DeviceId;
// Hunt 2: MsMpEng spawning unexpected child processes (post-RPC execution artifact)
let DefenderAbuse = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "MsMpEng.exe"
    | where FileName !in~ ("MpCmdRun.exe", "MsSense.exe", "MpDefenderCoreService.exe", "conhost.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, SHA256;
// Hunt 3: Non-system processes touching the SAM hive
let SAMAccess = DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "FileCreated" or ActionType == "FileModified"
    | where FileName has_any ("SAM", "SYSTEM") and FolderPath has "system32\\config"
    | where InitiatingProcessFileName !in~ ("System", "MsMpEng.exe", "svchost.exe", "smss.exe", "csrss.exe")
    | project TimeGenerated, DeviceName, ActionType, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
// Hunt 4: Known BlueHammer IoC hashes observed anywhere in process or file telemetry
let KnownHashes = dynamic(["f4ffef4204880031a6a532ff5c1b5686e6a301c365f492071c1d462fa5b6b4a0"]);
let HashHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ (KnownHashes) or MD5 =~ "8846f7eaee8fb117ad06bdd830b7586c"
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, ProcessCommandLine, AccountName;
union DefenderAbuse, SAMAccess, HashHits
| sort by TimeGenerated desc

# BlueHammer (CVE-2026-33825) IOC & Posture Hunt — Security Arsenal
# Run elevated on endpoints or deploy via RMM/SCCM. Outputs findings to CSV.

$report = @()

# --- 1. Defender platform version check (primary exposure indicator) ---
$mpStatus = Get-MpComputerStatus
$engineVer = $mpStatus.AMEngineVersion
$platformVer = $mpStatus.AMProductVersion
$vulnerable = $false
try {
    $vulnerable = ([version]$platformVer -lt [version]"4.18.26030.3011")
} catch { $vulnerable = $true }

$report += [PSCustomObject]@{
    Check   = "DefenderPlatformVersion"
    Finding = if ($vulnerable) { "VULNERABLE: $platformVer (< 4.18.26030.3011)" } else { "Patched: $platformVer" }
    Severity = if ($vulnerable) { "CRITICAL" } else { "Info" }
}

# --- 2. Known BlueHammer IoC hashes on disk (common staging paths) ---
$iocHashes = @(
    "8846f7eaee8fb117ad06bdd830b7586c",
    "f4ffef4204880031a6a532ff5c1b5686e6a301c365f492071c1d462fa5b6b4a0"
)
$searchPaths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\Users\Public", "$env:ProgramData")
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $h = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop
                if ($iocHashes -contains $h.Hash.ToLower()) {
                    $report += [PSCustomObject]@{ Check = "IoCHashMatch"; Finding = $_.FullName; Severity = "CRITICAL" }
                }
            } catch {}
        }
    }
}

# --- 3. Suspicious symlinks near Defender directories (stage 3 artifact) ---
$defenderPaths = @("$env:ProgramData\Microsoft\Windows Defender", "$env:ProgramFiles\Windows Defender")
foreach ($dp in $defenderPaths) {
    if (Test-Path $dp) {
        Get-ChildItem -Path $dp -Recurse -Force -ErrorAction SilentlyContinue |
            Where-Object { $_.LinkType -ne $null } | ForEach-Object {
                $report += [PSCustomObject]@{ Check = "SuspiciousSymlink"; Finding = "$($_.FullName) -> $($_.Target)"; Severity = "HIGH" }
            }
    }
}

# --- 4. Unexpected child processes of MsMpEng in last 7 days (Event 4688) ---
$mpChildren = Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688; StartTime = (Get-Date).AddDays(-7) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'MsMpEng\.exe' } |
    Where-Object { $_.Message -notmatch 'MpCmdRun|MsSense|conhost' }
foreach ($evt in $mpChildren) {
    $report += [PSCustomObject]@{ Check = "MsMpEngChildProcess"; Finding = $evt.Message.Substring(0, [Math]::Min(300, $evt.Message.Length)); Severity = "HIGH" }
}

# --- 5. LSASS handle audit (Sysmon Event 10, if deployed) ---
$lsassAccess = Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Sysmon/Operational'; Id = 10; StartTime = (Get-Date).AddDays(-7) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'lsass\.exe' -and $_.Message -notmatch 'MsMpEng|svchost|wininit' }
foreach ($evt in $lsassAccess) {
    $report += [PSCustomObject]@{ Check = "LSASSAccess"; Finding = $evt.TimeCreated.ToString() + " | " + $evt.Message.Substring(0, [Math]::Min(250, $evt.Message.Length)); Severity = "CRITICAL" }
}

# --- 6. Recent SAMR-heavy activity / NTLMv1 network logons (PtH artifacts) ---
$pthEvents = Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4624; StartTime = (Get-Date).AddDays(-3) } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'NtLmSsp' -and $_.Message -match 'NTLM V1' }
foreach ($evt in $pthEvents) {
    $report += [PSCustomObject]@{ Check = "PossiblePtH_NTLMv1"; Finding = $evt.TimeCreated.ToString(); Severity = "HIGH" }
}

$report | Export-Csv -Path ".\BlueHammer_Hunt_$(hostname)_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
$report | Format-Table -AutoSize