Cortex XDR | BlueHammer LPE - Suspicious VDM Signature File Access
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
Cortex XDR
