BlueHammer Zero-Day: What Windows Defender Users Must Know

By Seth Feldman | Head of Cyber Threat Engineering & Response

BlueHammer: A Public Exploit for an Unpatched Windows Defender Flaw

On April 3, 2026, a security researcher publicly released a working exploit for an unpatched vulnerability in Windows Defender. The exploit is called BlueHammer. It is real, it is confirmed, and Microsoft has not yet released a fix.

BlueHammer allows anyone with basic local access to a Windows machine to escalate their privileges all the way to SYSTEM. That is the highest level of access Windows offers. Think of it as going from "guest in the lobby" to "keys to every room in the building" with no alarms going off.

This is not theoretical. The full exploit code is publicly available on GitHub, it has been independently validated by well-known vulnerability researcher Will Dormann, and it works on Windows 10, Windows 11, and Windows Server 2022/2025. Every Windows endpoint running Defender is a potential target.

No CVE has been assigned. No patch exists. We are publishing this bulletin so Ostra customers can take protective action immediately.

The Threat: What BlueHammer Does

BlueHammer exploits a flaw in how Windows Defender processes its own signature updates. It does not rely on memory corruption or exotic kernel bugs. Instead, it chains together several legitimate Windows features in a way Microsoft never anticipated.

Here is the simplified version of what happens:

1. The exploit waits for a Defender update. Windows Defender regularly downloads signature updates to stay current against new threats. BlueHammer hooks into this process.

2. It freezes Defender mid-update. Using a lesser-known Windows feature called Cloud Files, the exploit effectively pauses Defender while it is in the middle of processing. Defender cannot protect the system while it is stuck.

3. It steals stored passwords. While Defender is frozen, the exploit redirects Defender's own file operations to access a protected system database called the SAM hive. This database contains the hashed passwords for every local account on the machine.

4. It takes over an admin account. With the password hashes in hand, the exploit changes a local administrator's password, logs in, creates a temporary system service, and obtains full SYSTEM-level access.

5. It covers its tracks. The exploit restores the original password afterward. To an outside observer, nothing appears to have changed.

The entire chain executes from an unprivileged user account. No admin credentials are needed to start the attack.

Why This Matters for Your Organization

Privilege escalation vulnerabilities like BlueHammer are the second step in almost every serious cyberattack. Ransomware operators, nation-state groups, and initial access brokers all need a way to move from a foothold to full control. A public, working exploit for SYSTEM-level access on any Windows machine is exactly what they look for.

The timeline is not on your side. History shows that threat actors weaponize public exploits within days of release. BlueHammer's code has already been forked over 250 times on GitHub. Groups like Qilin, Black Basta, and Scattered Spider have demonstrated they move fast when new privilege escalation tools become available.

Microsoft's response so far has been limited. They pushed a Defender signature that detects the original compiled exploit binary. But anyone can recompile the source code with minor changes and bypass that signature entirely. The underlying vulnerability remains open.

How Ostra Protects You

Ostra customers benefit from layered defenses that go well beyond relying on Windows Defender alone.

Endpoint Detection and Response is your strongest line of defense here. Unlike Defender's static signature, SentinelOne uses behavioral analysis to detect what an exploit does, not just what it looks like. The BlueHammer attack chain generates multiple behavioral signals that EDR can identify:

• Services being created from temporary directories

• Credential access patterns consistent with SAM database extraction

• Suspicious privilege escalation sequences

• Unusual process relationships, such as system shells spawning from newly created services

Our security operations team has developed targeted detection queries for BlueHammer. These queries are being deployed across Ostra customer environments to catch BlueHammer and any variants that may emerge.

Take These Steps Now to Reduce Your Risk

• Review local administrator accounts. Disable any local admin accounts that are not actively needed. BlueHammer targets local administrator credentials. Fewer active admin accounts means a smaller attack surface.

• Monitor for unusual password change events. Watch Windows Security Event Logs for Event IDs 4723 and 4724 occurring on the same account within seconds. This is the exploit's most visible forensic artifact.

• Restrict execution from temporary directories. Application control policies such as AppLocker or Windows Defender Application Control (WDAC) can prevent unsigned executables from running in user temp folders. This blocks the exploit's primary execution path.

• Do not rely on Defender's signature alone. Microsoft's detection only catches the original pre-compiled binary. Recompiled variants will evade it. Behavioral detection is what matters here.

• Patch promptly when Microsoft releases a fix. No patch exists today, but when one arrives, prioritize it. We will notify Ostra customers as soon as a fix is available.

• Report suspicious activity immediately. If you observe unexpected SYSTEM-level processes, unexplained service creation, or password change alerts on admin accounts, contact Ostra's security operations team right away.

BlueHammer Is Serious — but Defensible with Layered Detection

BlueHammer is a serious threat. It is public, confirmed, and unpatched. But it is also detectable and defensible with the right tools in place.

The organizations most at risk are those relying solely on Windows Defender without layered endpoint protection. Ostra's deployment of EDR behavioral detection, combined with correlation, provides meaningful defense against this exploit chain even before Microsoft delivers a patch.

We are actively monitoring the situation. If you have questions about your organization's exposure, reach out to our team.