Anomalous Access on Defender Signature File (BlueHammer LPE)
** Derived KQL from published Sigma rule created by @timpeck of the same title** Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm). This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Microsoft Sentinel (KQL)
