CVE-2026-33825: BlueHammer Microsoft Defender Zero-Day — Detection and Incident Response

---
title: BlueHammer - Suspicious MpCmdRun Execution
defid: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious command-line arguments used by MpCmdRun.exe to disable definitions or scanning, often used post-exploitation to maintain persistence after BlueHammer exploitation.
references:
  - https://securityarsenal.com/intel/incident-response
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\MpCmdRun.exe'
    CommandLine|contains:
      - '-RemoveDefinitions '
      - '-DisableService '
      - '-DisableIOAVProtection'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting (rare)
level: high
---
title: BlueHammer - Defender Service Tampering Event
defid: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Event ID 1117 indicating Windows Defender detected and blocked changes to its settings, or failures in the antimalware engine consistent with exploit activity.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  product: windows
  service: microsoft-defender-antivirus
detection:
  selection:
    EventID: 1117
  filter:
    ThreatName|contains: 'HackTool:Win32/MpCmdRun' # Potential false positive from admin tools
  condition: selection and not filter
falsepositives:
  - Administrator modifying Defender configuration via Group Policy or Intune
level: medium

// Hunt for BlueHammer exploit indicators
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for MsMpEng.exe (Defender Service) crashing or restarting anomalously
| where FileName in~ ("MsMpEng.exe", "NisSrv.exe")
| where ActionType in ("ProcessTerminated", "ProcessHung", "ProcessCrashed")
| project DeviceName, Timestamp, FileName, ProcessId, AccountName, FolderPath
| join kind=inner (
    // Look for suspicious executions occurring immediately after Defender instability
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName !in~ ("MsMpEng.exe", "NisSrv.exe", "Services.exe", "svchost.exe")
    | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powershell.exe", "cmd.exe")
    | extend ProcessChain = pack_all()
) on DeviceName
| where Timestamp1 between (Timestamp .. Timestamp + 5m)
| project DeviceName, Timestamp, VulnerableProcess=FileName, SuspiciousProcess=FileName1, SuspiciousCommandLine=CommandLine1, AccountName1

-- Hunt for suspicious MpCmdRun.exe execution chains
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ "MpCmdRun.exe"
   AND (CommandLine =~ "-RemoveDefinitions" 
        OR CommandLine =~ "-DisableService" 
        OR CommandLine =~ "-RestoreDefaults")

-- Check for Defender Engine Version (Requires admin access)
SELECT 
    FullPath,
    Version,
    Mtime
FROM glob(globs="C:\ProgramData\Microsoft\Windows Defender\Platform\*\MpEngine.dll")
ORDER BY Mtime DESC
LIMIT 1

# Check Defender Platform Version and Tamper Protection
Write-Host "[+] Checking Microsoft Defender Health and CVE-2026-33825 Patch Status..."

# Get MpEngine.dll Version to check if patch is applied (Update to latest platform)
$mpEnginePath = "C:\ProgramData\Microsoft\Windows Defender\Platform\*\MpEngine.dll"
$latestEngine = Get-Item $mpEnginePath | Sort-Object LastWriteTime -Descending | Select-Object -First 1

if ($latestEngine) {
    Write-Host "[+] Current MpEngine Version: $($latestEngine.VersionInfo.FileVersion)"
    # Logic: Ensure version is newer than the vulnerable release date range (May 2026 patches)
    # In a real scenario, compare against a hardcoded safe version string.
} else {
    Write-Host "[-] ERROR: Could not locate MpEngine.dll. Defender may be disabled or broken."
}

# Check Tamper Protection Status (Requires registry check on newer OS builds)
try {
    $tamperPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
    $tamperStatus = (Get-ItemProperty -Path $tamperPath -ErrorAction Stop).TamperProtection
    
    if ($tamperStatus -eq 5) { # 5 usually corresponds to 'On' in some builds, though varies
        Write-Host "[+] Tamper Protection: ENABLED"
    } elseif ($tamperStatus -eq 4) {
        Write-Host "[!] Tamper Protection: LIMITED (Not Recommended)"
    } else {
        Write-Host "[-] Tamper Protection: DISABLED (CRITICAL RISK)"
        Write-Host "[ACTION ITEM] Enable Tamper Protection via Intune or Security Center immediately."
    }
} catch {
    Write-Host "[-] Could not verify Tamper Protection status via Registry."
}

# Force a Defender Update
Write-Host "[+] Attempting to update Defender intelligence..."
Start-Process -FilePath "C:\Program Files\Windows Defender\MpCmdRun.exe" -ArgumentList "-SignatureUpdate" -NoNewWindow -Wait
Write-Host "[+] Update check complete."