BlueHammer - Suspicious VDM Signature File Access

Georg Lauenstein@gsec

•updated Apr 8, 2026•23•1•2,023

Detects non-Defender processes accessing mpasbase.vdm signature definition files. The BlueHammer exploit acquires a batch oplock on this file to freeze Defender mid-read, then swaps the underlying junction target to redirect SYSTEM-context reads to the SAM hive in a VSS snapshot. Non-Defender access to VDM files has zero legitimate use cases.