Anomalous Access on Defender Signature File (BlueHammer LPE)

Tim Peck@timpeck

•updated Apr 8, 2026•66•4•1,536

Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm). This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.