BlueHammer (CVE‑2026‑33825) Enables Local Privilege Escalation to Domain Admin via Windows Defender
What It Is – BlueHammer is a multi‑stage local privilege‑escalation chain that abuses the Windows Defender Antimalware Platform (versions < 4.18.26030.3011). It leverages CloudFilter callbacks, batch oplocks, object‑manager symlinks, Defender’s update RPC, offline SAM parsing and SAMR to move from a standard‑user foothold to NT AUTHORITY\SYSTEM, then extracts domain‑admin credentials from LSASS and performs pass‑the‑hash lateral movement.
Exploitability – The chain requires initial user‑level code execution (e.g., via phishing or a malicious macro). In lab tests the exploit succeeded against vulnerable Defender builds, but runtime factors such as pending signature updates, filter‑driver state, and VSS configuration affect success on a given host. No public exploit‑as‑a‑service is known; exploitation is currently limited to targeted, manual attempts.
Affected Products – Microsoft Windows Defender Antimalware Platform (all Windows 10/11 and Windows Server editions with Defender version < 4.18.26030.3011).
Why It Matters for Trust & Control Assurance
- Patch‑Management Evidence – Demonstrating that endpoint agents are running the latest, non‑vulnerable Defender version is a concrete control‑objective evidence point across SOC 2, ISO 27001, NIST CSF and other frameworks.
- Continuous Exploit‑Validation – Qualys’ TruConfirm approach (environmental checks + non‑destructive BAS validation) provides audit‑ready proof that a host is not exploitable, turning a “potential” risk into a verified control state.
- Credential‑Protection Controls – The ability to extract LSASS secrets underscores the need for robust credential‑hardening (e.g., Credential Guard, LSA protection) and continuous monitoring of privileged‑access activity.
Recommended Actions
- Verify Defender version on all endpoints; upgrade any host below 4.18.26030.3011.
- Enable and tune Qualys TruConfirm (or equivalent) exploit‑validation scans to obtain evidence of remediation.
- Deploy credential‑hardening (Windows Credential Guard, LSA protection) and monitor LSASS access via EDR.
- Update detection rules (MITRE ATT&CK T1548.003, T1003) in SIEM/EDR to alert on the eight‑stage chain indicators.