BlueHammer CVE-2026-33825 Chains Defender Components for Local SYSTEM Access
Summary
Qualys details BlueHammer, an eight-stage Windows Defender local privilege-escalation chain that reached SYSTEM in lab testing. It requires prior standard-user code execution; Defender platform 4.18.26030.3011 or later closes the vulnerable path.
Key points
- Qualys reports that its original PoC reached NT AUTHORITY\SYSTEM on a tested host running Defender platform 4.18.2104.10; the exploit does not provide initial access.
- The chain combines CloudFilter callbacks, batch oplocks, object-manager symlinks, and Defender’s local update RPC interface; runtime conditions affect whether the path is reachable.
- In the lab, SYSTEM access enabled recovery of domain-admin credentials already present in LSASS, followed by pass-the-hash access to a domain controller. This was a demonstrated test path, not an automatic capability of the local privilege-escalation vulnerability.
- Qualys says TruConfirm checks host prerequisites and safely validates the CloudFilter freeze, stopping before SAM extraction, password changes, service creation, or shell execution.
- The article identifies correlated CloudFilter, oplock, RPC, symlink, SAMR, password-change, and service-creation activity as hunting signals; static indicators may be changed in modified builds.
- The article identifies Defender Antimalware Platform 4.18.26030.3011 or later as the fixed boundary and recommends restricting privileged domain logons on workstations.
Article Details
- Attack Vectors
- BlueHammer requires prior standard-user code execution; it does not provide initial access.
- The local privilege-escalation chain freezes MsMpEng.exe through a CloudFilter callback, then uses a timed batch-oplock and object-manager symlink race to make Defender access the SAM hive from a VSS shadow copy.
- The exploit parses the SAM hive offline and uses SAMR to replace an administrator account's password hash, then creates a temporary service that runs its payload as NT AUTHORITY\SYSTEM.
- In the lab, the resulting SYSTEM access was used with Mimikatz to retrieve cached domain-administrator credentials from LSASS, followed by pass-the-hash authentication to a domain controller.
- Defensive Notes
- Update Defender Antimalware Platform to version 4.18.26030.3011 or later, which the article identifies as the fixed boundary for CVE-2026-33825.
- Assess host-specific exploit prerequisites and reachability rather than relying only on version detection; the article describes TruConfirm's non-destructive validation of the CloudFilter freeze.
- Correlate CloudFilter sync-root registration, batch oplocks, Defender update-engine RPC activity, object-manager symlink changes, SAMR password changes, and unexpected service creation.
- Restrict privileged domain logons on workstations; use administrative tiering and Remote Credential Guard where supported.
- Use WDAC or AppLocker to block unapproved executables, enable Credential Guard and LSA Protection, and deploy Windows LAPS to limit credential reuse.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | f4ffef4204880031a6a532ff5c1b5686e6a301c365f492071c1d462fa5b6b4a0 | SHA-256 identified for the original FunnyApp.exe BlueHammer proof-of-concept binary used in the analysis. |
MITRE ATT&CK
T1003.001 · LSASS MemoryIn the lab, Mimikatz was used from the SYSTEM shell to retrieve cached domain credentials from LSASS.T1003.002 · Security Account ManagerThe exploit parses the SAM hive offline and decrypts account NT hashes.T1068 · Exploitation for Privilege EscalationAn oplock-timed symlink race makes Defender access the SAM hive using its SYSTEM token, enabling local privilege escalation.T1098 · Account ManipulationThe exploit uses SAMR to replace the local administrator account's NT hash.T1134.001 · Token Impersonation/TheftThe exploit retrieves an elevated linked token and duplicates a SYSTEM token into the user's session.T1211 · Exploitation for StealthThe article maps the CloudFilter callback that freezes MsMpEng.exe during scanning to this technique.T1518.001 · Security Software DiscoveryThe exploit queries IUpdateSession to check whether a Defender signature update is pending.T1543.003 · Windows ServiceThe exploit creates a temporary GUID-named Windows service that launches its binary as NT AUTHORITY\SYSTEM.T1550.002 · Pass the HashThe lab used a recovered NTLM hash with Mimikatz and PsExec to authenticate to the domain controller.T1559 · Inter-Process CommunicationThe exploit invokes Defender's MpAmDefinitionUpdateAPI over ncalrpc.
CVE
Vendors
MicrosoftMicrosoft identifies Defender Antimalware Platform versions earlier than 4.18.26030.3011 as affected; our reverse-engineering host ran version 4.18.2104.10.QualysThat’s the gap version-based scanning can’t close. Qualys TruConfirm marks a host Exploit Validated only after environmental checks, plus a non-destructive BAS validation of the CloudFilter freeze (Stages 2–3), no SAM
Products
AppLockerEnforce WDAC or AppLocker. A properly scoped allowlist can block the unsigned PoC and similar unapproved executables before execution.Credential GuardUse Remote Credential Guard where supported.Qualys TruConfirmThat’s the gap version-based scanning can’t close. Qualys TruConfirm marks a host Exploit Validated only after environmental checks, plus a non-destructive BAS validation of the CloudFilter freeze (Stages 2–3), no SAMQualys VMDRIn tests conducted on a vulnerable host, the TruConfirm signature yielded a critical finding in Qualys VMDR, identifying CVE-2026-33825 and linking it to the specific asset evaluated.WDACEnforce WDAC or AppLocker. A properly scoped allowlist can block the unsigned PoC and similar unapproved executables before execution.Windows 11Host: DESKTOP38, Windows 11 Pro 21H2, OS build 22000.2295Windows DefenderBlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting the Windows Defender Antimalware Platform before 4.18.26030.3011. It does not grant initial access; an attacker needsWindows LAPSDeploy Windows LAPS. Unique, automatically rotated local-administrator passwords limit credential reuse between endpoints.
Tools
IDA ProWe reconstructed the chain by reverse-engineering the original FunnyApp.exe binary in IDA Pro and tracing it in x64dbg.MimikatzIn our lab setup, we used the SYSTEM shell to retrieve sensitive data from LSASS with Mimikatz.PsExecSubsequently, we authenticated the domain controller using the NTLM hash through PsExec.Qualys Breach and Attack SimulationFollowing this, it employs a modified Qualys Breach and Attack Simulation workflow to replicate only the non-destructive aspects of the exploit.x64dbgWe reconstructed the chain by reverse-engineering the original FunnyApp.exe binary in IDA Pro and tracing it in x64dbg.