BlueHammer CVE-2026-33825 — Microsoft Defender LPE (BlueHammer / RedSun)

CVE-2026-33825 ("BlueHammer") is a local privilege-escalation flaw (CVSS 7.8) in Microsoft Defender Antivirus. It is a time-of-check-to-time-of-use (TOCTOU) race in Defender's threat-remediation engine: an attacker plants a file Defender will quarantine, uses a batch opportunistic lock (oplock) to pause Defender mid-operation, then swaps in an NTFS junction that redirects Defender's privileged write from a temp directory into C:\Windows\System32. When the oplock releases, Defender (running as SYSTEM) follows the junction and writes to the protected location — yielding SYSTEM code execution and an arbitrary read handle to the SAM database (local password hashes). A sibling technique, RedSun, abuses Defender's cloud file-rollback mechanism via the Windows Cloud Files API to achieve the same System32 overwrite.

PoC tooling ("Nightmare-Eclipse") leaked in early April 2026; Microsoft patched in the April 2026 Patch Tuesday; CISA added the CVE to the KEV catalog on April 22, 2026; and on June 30, 2026 CISA confirmed it is now being exploited by ransomware gangs as a privilege-escalation and credential-access step. Affected: Windows 10/11 and Server 2016–2025 running Defender builds prior to the April 2026 update.

Highest-value defensive angle: the exploit's signature is the security product itself behaving abnormally — MsMpEng.exe writing an executable into System32, junction/reparse creation pointing at System32, and post-escalation SAM-hive access. None of these are benign in a healthy environment, so behavioral hunts are high-fidelity even without atomic IOCs. The fastest win, however, is verifying the April 2026 Defender platform update is actually deployed fleet-wide.

Defender priority: Confirm Defender platform/engine is patched (≥ April 2026) on every endpoint, then hunt Q1 (MsMpEng.exe → PE into System32) and Q3 (SAM-hive access). Treat any hit as an active ransomware-precursor escalation — isolate and assume credential theft.

Intel note: No atomic file hashes or C2 were published for the Nightmare-Eclipse tooling at access time. Coverage here is behavior-led against the exploit primitive (Defender → System32 write, junction-to-System32, SAM access); atomic-IOC slots in §10 are placeholders.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): MsMpEng.exe (Defender) writes a PE/executable into System32 — the junction-redirected privileged write at the heart of BlueHammer/RedSun.
2. H2 (high): A non-system process creates an NTFS junction / reparse point targeting System32 (or uses mklink/fsutil reparsepoint against a system path).
3. H3 (high): A process accesses or copies the SAM/SYSTEM registry hives (reg save HKLM\SAM, esentutl on SAM, direct System32\config\SAM reference) — post-escalation credential access.
4. H4 (medium): A SYSTEM-integrity process launches from a user-writable directory (Users/Temp/ProgramData) shortly after Defender remediation activity — post-LPE payload.
5. H5 (medium, IOC): Known Nightmare-Eclipse tooling executes (by hash, once published).
6. H6 (config): Endpoints reporting Defender platform/engine builds older than the April 2026 update — exposure surface.

Attack chain

No atomic hashes/IPs were published in primary sources at access time (2026-06-30). The SHA256 row is an explicit placeholder — do not deploy as-is.

Defender / patch posture (do this first)

• Get-MpComputerStatus — confirm AMEngineVersion / AMProductVersion reflect the April 2026 (or later) update on every host. Anything older is exposed.
• Review Microsoft Update / WSUS / Intune compliance for the April 2026 Patch Tuesday rollout coverage.

Windows event logs

• Sysmon Event ID 11 (FileCreate) for executable writes into C:\Windows\System32 with image MsMpEng.exe — corroborates Q1 where Sysmon is deployed.
• Security 4656/4663 — handle requests / access to \Device\...\config\SAM by non-system processes.
• Defender Operational log (Microsoft-Windows-Windows Defender/Operational) — remediation events immediately preceding anomalous System32 changes.
• Hunt for reparse-point creation (Sysmon EID 11/2 or USN journal) where the target resolves into System32.

Promote Defender-Writes-System32 first — it is essentially FP-free and maps directly to the exploit primitive.

One-click blocks. The behavioral, audit, and patch-gate blocks are deployable today; the atomic hash row is a placeholder until vendors publish.

type,value,action,severity,expiration,description,tags
sha256,REPLACE_WITH_NIGHTMARE_ECLIPSE_SHA256,prevent,critical,2026-12-30,BlueHammer/Nightmare-Eclipse tool,campaign:CVE-2026-33825

MsMpEng.exe -> writes PE into C:\Windows\System32
Non-admin proc -> mklink / fsutil reparsepoint / CreateSymbolicLink -> System32
proc -> reg save HKLM\SAM  |  esentutl ...SAM  |  read System32\config\SAM
SYSTEM-integrity proc launched from \Users\ \Temp\ \ProgramData\

CVE-2026-33825 "BlueHammer" - TOCTOU in Defender remediation; oplock + NTFS
  junction redirect write into System32 as SYSTEM; arbitrary read handle to SAM.
RedSun - sibling technique abusing Defender cloud file-rollback (Cloud Files API).
Nightmare-Eclipse - leaked PoC tooling (early April 2026); seen in live intrusion.
Patch: April 2026 Patch Tuesday. KEV: 2026-04-22. Ransomware use: 2026-06-30.

# Confirm Defender platform/engine is the April-2026 update or newer:
Get-MpComputerStatus | Select-Object AMProductVersion, AMEngineVersion, `
  AMServiceVersion, NISEngineVersion, AntivirusSignatureLastUpdated
# Flag any host whose AMProductVersion predates the April 2026 platform update.

⚠ Verify in tenant: confirm the exact April 2026 Defender platform build number against current MSRC guidance before treating a host as patched.

1 · Verify Defender platform update (PowerShell, fleet)

# Report Defender versions; flag hosts that predate the April 2026 platform update.
$s = Get-MpComputerStatus
[pscustomobject]@{
  Host             = $env:COMPUTERNAME
  AMProductVersion = $s.AMProductVersion
  AMEngineVersion  = $s.AMEngineVersion
  SignaturesUpdated= $s.AntivirusSignatureLastUpdated
} | Format-List
# Push via your RMM and alert on any AMProductVersion older than the April 2026 build.

2 · Restrict symlink/junction creation to admins (secedit / GPO)

# User Rights Assignment: "Create symbolic links" (SeCreateSymbolicLinkPrivilege)
# GPO path: Computer Config > Policies > Windows Settings > Security Settings >
#           Local Policies > User Rights Assignment > Create symbolic links
# Set to: Administrators only (remove any broad/user groups).
# Verify on a host:
whoami /priv | findstr SeCreateSymbolicLinkPrivilege

3 · Falcon CQL spot-check after patch

# Should return ZERO once patched + IOAs in place:
#event_simpleName=/PeFileWritten/
| ContextBaseFileName=/^MsMpEng\.exe$/i
| TargetFileName=/System32/i
| table([ComputerName, TargetFileName])

Strongest coverage is the exploit primitive and its payoff (Q1, Q3 — high CONF, low FP, IOA-ready). Gaps: atomic tooling hash (pending publication) and downstream ransomware impact (own pack). Validation: baseline Q2/Q4 for benign junction creators / SYSTEM updaters before promoting to Block.