BlueHammer/RedSun: MsMpEng.exe Junction-Redirect Write to System32 or Shell Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.