BlueHammer: The Unpatched Windows Zero-Day That Weaponizes Microsoft Defender Against Your Own System
- Created
- 17 Apr 2026
- Last reply
- 6 months ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article BlueHammer: The Unpatched Windows Zero-Day That Weaponizes Microsoft Defender Against Your Own System.
BlueHammer is an unpatched, publicly released Windows local privilege escalation exploit that chains Microsoft Defender's update workflow, Volume Shadow Copy, Cloud Files callbacks, and opportunistic locks to reach NT AUTHORITY\SYSTEM from a standard user account.
Discussion thread — share findings, corrections and follow-ups below.