Windows zero day PoC released by security researcher

Rafi Mahmood

• On 3 April, a security researcher released an exploit proof of concept (PoC) for an undisclosed Windows local privilege escalation vulnerability, dubbed BlueHammer, allegedly due to frustration with Microsoft’s Security Response Centre.
• The vulnerability is a race condition due to the interaction between Microsoft Defender's update workflow, Volume Shadow Copy Service, the Windows Cloud Files API, and opportunistic locks, with the exploit abusing this to escalate a low-privilege user to SYSTEM.
• Microsoft has updated Defender signatures to detect the PoC, however, this detection is specific to the binary and does not cover the behavioural interactions of the Windows components in such a chain.
• Organisations should monitor for VSS enumeration from non-system processes, unexpected password changes on local Administrator accounts, and enforce the principle of least privilege where possible, limiting what compromised user accounts can interact with to significantly reduce the attack surface.

GitHub | Nightmare-Eclipse/BlueHammer: Repository hosting the bluehammer vulnerability
Cyderes | Howler Cell | BlueHammer: Inside the Windows Zero-Day