Suspicious Restricted Path Symlink (BlueHammer Zero-Day LPE)

Thiru N@Iamthiru

•updated Apr 20, 2026•9•0•890

Detects the creation of symbolic links targeting the Restricted kernel object namespace, which the BlueHammer exploit uses for path confusion during a TOCTOU race condition to achieve Local Privilege Escalation.