BlueHammer Windows Zero-Day: Unpatched LPE Exploit Detection & Mitigation

---
title: Potential BlueHammer Exploit PoC Execution
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects the execution of the BlueHammer PoC based on known filename patterns associated with the Chaotic Eclipse release.
references:
  - https://www.darkreading.com/vulnerabilities-threats/bluehammer-windows-exploit-microsoft-bug-disclosure-issues
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - 'bluehammer'
      - 'chaotic'
      - 'poc.exe'
  selection_cli:
    CommandLine|contains:
      - '--exploit'
      - 'bluehammer'
  condition: 1 of selection_
falsepositives:
  - Legitimate security testing (if authorized)
level: critical
---
title: Suspicious Service Creation by Non-Admin User
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects the creation of a new Windows service using sc.exe or PowerShell by a user that is not a local administrator, often a sign of successful LPE.
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.privilege_escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'create'
      - 'New-Service'
  filter_admin:
    SubjectUserName|contains:
      - 'Administrator'
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      'NETWORK SERVICE'
  condition: selection_sc and not filter_admin
falsepositives:
  - Authorized administration by technicians
level: high

// KQL for Microsoft Sentinel / Defender 365
// Hunt for suspicious process execution related to BlueHammer PoC
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has_any ("bluehammer", "poc", "chaotic") 
   or ProcessCommandLine has_any ("bluehammer", "--exploit", "chaotic")
| extend AccountCustomEntity = AccountName, HostCustomEntity = DeviceName, ProcessCustomEntity = ProcessVersionInfoOriginalFileName
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by Timestamp desc

// Velociraptor VQL to hunt for the PoC file and Suspicious Service Creation
// Hunt for processes named bluehammer or generic poc
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "bluehammer" OR Name =~ "poc" 

// Hunt for the specific file on disk
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs="\\Users\*\\Downloads\\*bluehammer*")

# Remediation Script: Audit Local Administrators & Enable Exploit Protection
# Run this script to identify potential attack vectors and harden the OS

Write-Host "[+] Starting BlueHammer Hardening Audit..." -ForegroundColor Cyan

# 1. Identify Local Users with Administrative Privileges (The required entry vector)
Write-Host "\n[!] Auditing Local Administrators Group:" -ForegroundColor Yellow
try {
    $admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop
    foreach ($admin in $admins) {
        if ($admin.SID.Value -notlike "S-1-5-21-*-500" -and $admin.SID.Value -notlike "S-1-5-32-544") {
            Write-Host "Found Non-Default Admin: $($admin.Name) ($($admin.SID.Value))" -ForegroundColor Red
        }
    }
} catch {
    Write-Host "Failed to audit local admins: $_" -ForegroundColor Red
}

# 2. Enable System-wide Exploit Protection Mitigations (SEHOP/ASLR)
Write-Host "\n[+] Configuring System Exploit Protection Settings..." -ForegroundColor Yellow
try {
    # Enable System Guard Runtime Monitor Integrity enforcement if supported
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 1 -Type DWord -ErrorAction SilentlyContinue
    
    # Turn on randomization for images (Mandatory ASLR)
    Set-ProcessMitigation -System -Enable ForceRelocateImages -ErrorAction SilentlyContinue
    Write-Host "Hardening applied. A reboot may be required." -ForegroundColor Green
} catch {
    Write-Host "Failed to apply exploit protection: $_" -ForegroundColor Red
}

# 3. Check for presence of BlueHammer artifacts (heuristic)
Write-Host "\n[!] Checking C:\\Temp and User Downloads for POCs..." -ForegroundColor Yellow
$paths = @("C:\Temp", "C:\Users\Public\Downloads", "$env:USERPROFILE\Downloads")
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Filter "*bluehammer*" -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime | Format-Table
    }
}
Write-Host "Audit Complete." -ForegroundColor Green