# BlueHammer Windows Zero-Day Local Privilege Escalation to SYSTEM via TOCTOU Race Condition and Path Confusion

> BlueHammer is an unpatched Windows local privilege escalation zero-day that exploits a TOCTOU race condition in Windows Defender's signature update process combined with path confusion via junction swapping to gain access to the SAM database and escalate to NT AUTHORITY\SYSTEM. A functional PoC was publicly leaked on GitHub on April 3, 2026 by researcher Nightmare-Eclipse after a disclosure dispute with Microsoft MSRC. No CVE has been assigned and no patch is available.

- **Published:** 2026-04-07T12:00:00Z
- **Last reviewed:** 2026-04-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0329
- **ID:** TL-2026-0329
- **Severity:** HIGH (CVSS 7.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BlueHammer is a sophisticated local privilege escalation (LPE) zero-day exploit targeting the Windows Defender signature update mechanism. The vulnerability chains a Time-of-Check-Time-of-Use (TOCTOU) race condition with path confusion to achieve SYSTEM-level access on Windows systems.

The exploit operates through six coordinated stages. First, it retrieves a legitimate Windows Defender signature update from Microsoft's official URL (go.microsoft.com). Second, it drops a reversed EICAR test file and monitors Volume Shadow Copy snapshots via NtQueryDirectoryObject. Third, it registers a Cloud Files sync root with a callback that identifies the Windows Defender process by PID using the CfRegisterSyncRoot and CfConnectSyncRoot APIs. Fourth, it takes a batch oplock on the mpasbase.vdm file and swaps directory junctions to \BaseNamedObjects\Restricted using NtCreateSymbolicLinkObject. Fifth, it triggers the update process by invoking Proc42_ServerMpUpdateEngineSignature via the Windows Defender RPC interface. Finally, it exploits the resulting race condition to access the Security Account Manager (SAM) database, extracts password hashes using offline registry parsing (OROpenHive), modifies the user password, creates a temporary SYSTEM service for privilege escalation, and then restores the original NT hashes to avoid detection.

SAM hash decryption supports both AES (Revision 3) and RC4 (Revision 2) for SAM key decryption, with AES or RC4 plus DES-ECB for NT hash decryption. The boot key is extracted from the live SYSTEM registry class names with permutation.

The exploit codebase is structured across multiple modules: update.cpp (PE resource parsing, cabinet extraction via FDI), vss.cpp (EICAR drops, VSS monitoring), cloudfiles.cpp (Cloud Files sync root registration with batch oplock), race.cpp (junction swapping, symbolic link creation), sam.cpp (offline SAM parsing via OROpenHive), escalate.cpp (Net API password changes, service creation), and main.cpp (stage orchestration). The PoC dynamically loads cldapi.dll, offreg.dll, and samlib.dll at runtime.

The exploit has been confirmed functional on Windows 11 25H2 by security researcher Will Dormann, principal vulnerability analyst at Tharros. Testing indicates it is non-functional on Windows 11 22H2, 23H2, and 24H2. On Windows Server platforms, the exploit is limited to escalating from non-admin to elevated administrator rather than full SYSTEM access. The PoC contains intentional bugs that reduce reliability but is acknowledged as operationally useful.

The researcher, operating under the aliases Chaotic Eclipse and Nightmare-Eclipse, published the exploit on GitHub on April 3, 2026 after frustrations with Microsoft's Security Response Center (MSRC) handling of the vulnerability disclosure. MSRC reportedly required a video demonstration of the exploit as part of the submission process, which the researcher viewed as an unreasonable friction point. The researcher stated: 'I was not bluffing Microsoft, and I'm doing it again' and 'I'm not explaining how this works; y'all geniuses can figure it out.'

The exploit exhibits notable operational security characteristics: it makes only a single network connection to a legitimate Microsoft URL, deletes the temporary SYSTEM service after exploitation, and restores original NT hashes to minimize forensic evidence. These anti-forensic features increase the risk if adopted by ransomware groups or advanced threat actors for post-compromise privilege escalation.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1003 OS Credential Dumping
- T1685 Disable or Modify Tools
- T1569 System Services
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1106 Native API
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1082 System Information Discovery
- T1036 Masquerading
- T1556 Modify Authentication Process

## Sources

- [BleepingComputer: Disgruntled researcher leaks BlueHammer Windows zero-day exploit](https://www.bleepingcomputer.com/news/security/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit/)
- [SOCRadar: BlueHammer Windows Zero-Day Privilege Escalation Risk](https://socradar.io/blog/bluehammer-windows-zero-day-privilege-escalation-risk/)
- [Security Affairs: Experts published unpatched Windows zero-day BlueHammer](https://securityaffairs.com/190400/breaking-news/experts-published-unpatched-windows-zero-day-bluehammer.html)
- [SecurityOnline: BlueHammer Windows Defender 0-Day LPE Exploit](https://securityonline.info/bluehammer-windows-defender-0-day-lpe-exploit/)
- [CybersecurityNews: Researcher Released Windows Defender 0-Day Exploit Code](https://cybersecuritynews.com/windows-defender-0-day-exploit/)
- [GitHub PoC: Nightmare-Eclipse/BlueHammer](https://github.com/Nightmare-Eclipse/BlueHammer)
- [GitHub: 0xjustBen/BlueHammer — Reattempt with detailed technical analysis](https://github.com/0xjustBen/BlueHammer)
- [TechNadu: BlueHammer Windows Zero-Day Exploit Leaks Online](https://www.technadu.com/bluehammer-zero-day-exploit-leverages-windows-privilege-escalation-prompts-security-concerns/625409/)
- [GBHackers: Windows Defender 0-Day Published Online](https://gbhackers.com/windows-defender-0-day-published-online/)
- [CyberPress: Researcher Releases Windows Defender 0-Day Exploit Granting Full System Access](https://cyberpress.org/releases-windows-defender-0-day/)
- [News9Live: BlueHammer — Researcher drops Windows zero-day exploit](https://www.news9live.com/technology/tech-news/bluehammer-windows-zero-day-exploit-researcher-i-was-not-bluffing-2953064)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0329