CRITICAL: Three Microsoft Defender Zero-Days
Actively Exploited in the Wild —
CVE-2026-33825 (BlueHammer / RedSun / UnDefend)

On April 7, 2026, a zero-day vulnerability in Microsoft Defender was publicly disclosed alongside a fully functional proof-of-concept exploit named BlueHammer. Within days, two additional exploitation frameworks — RedSun and UnDefend — were deployed in active campaigns. All three vulnerabilities are rooted in CVE-2026-33825, a Time-of-Check to Time-of-Use (TOCTOU) race condition within Windows Defender's threat remediation engine.

Microsoft patched one of the three flaws in the April 2026 Patch Tuesday cycle (14 April). Two variants remain UNPATCHED at time of publication. The exploited code path allows a low-privileged local attacker to escalate privileges to NT AUTHORITY\SYSTEM — the highest privilege level on Windows — enabling full system takeover, credential dumping, ransomware deployment, and lateral movement.

Organizations relying on Windows Defender as their primary endpoint protection layer face compounded risk: the vulnerability resides within the security product itself, meaning exploitation may circumvent detection by the very tool designed to prevent it.

Threat actors observed in the wild combine all three exploits in a sequential attack chain. Below is the full kill chain reconstructed from incident telemetry.

The following IOCs are extracted from observed exploitation campaigns. Block these immediately across all network egress points, EDR platforms, and SIEM correlation rules.

Active Weaponization Timeline

The following table documents confirmed exploit availability and active weaponization status as of April 22, 2026:

Windows Defender is the default endpoint protection for over 1 billion Windows endpoints globally. The attack surface for this vulnerability is exceptionally broad. Particularly at risk are organizations that rely solely on Defender without a layered EDR strategy.

Process Anomaly Detection

The highest-fidelity detection signal is anomalous child process spawning from MsMpEng.exe. No legitimate Defender operation spawns cmd.exe, powershell.exe, or wscript.exe as child processes.

DeviceProcessEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe",
                       "cscript.exe", "mshta.exe", "rundll32.exe")
| where InitiatingProcessIntegrityLevel == "System"
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessCommandLine

TOCTOU Race Condition Artifacts

BlueHammer leaves detectable artifacts in the Windows file system: temporary symlinks created in %TEMP% pointing to system paths during the race window.

Event ID: 11 (FileCreate) + Event ID: 23 (FileDelete)
Target: %TEMP%\*.tmp files with reparse point attributes
Correlate with: Defender scan activity (Event 1116, 1117)
within a 5-second window — indicates active TOCTOU exploitation

Registry Tamper Detection

Event ID: 13 (RegistryEvent - Value Set)
TargetObject: *\Image File Execution Options\MsMpEng.exe\Debugger
Alert: CRITICAL — Immediate containment recommended

YARA Rule — BlueHammer Binary

rule BlueHammer_Exploit_CVE_2026_33825 {
    meta:
        description = "Detects BlueHammer exploit binary"
        author      = "CYBERDUDEBIVASH SENTINEL APEX — CyberDudeBivash"
        date        = "2026-04-22"
        severity    = "CRITICAL"
        reference   = "CVE-2026-33825"
    strings:
        $sym1 = "bhammer_stg" ascii nocase
        $sym2 = { 4D 73 4D 70 45 6E 67 2E 65 78 65 } // MsMpEng.exe
        $sym3 = "NtSetValueKey" ascii
        $sym4 = "SYSTEM\\CurrentControlSet\\Services\\WinDefend" ascii
        $race_marker = { 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 }
    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        3 of ($sym*, $race_marker)
}

• ✓
  Apply KB5055523 immediately — Microsoft's April 14 patch addresses CVE-2026-33825 (BlueHammer). Deploy via WSUS/SCCM/Intune with maximum urgency. Reboot required. Track patch compliance via your vulnerability management platform.
• ✓
  Enable Microsoft Defender Tamper Protection — While UnDefend bypasses this in some configurations, enabling Tamper Protection adds an additional detection layer and forces attackers to use noisier methods. Verify via Intune compliance policies.
• ✓
  Deploy process creation monitoring for MsMpEng.exe — Immediately push the KQL detection rule above across Microsoft Defender for Endpoint / Sentinel. Set alert severity to Critical. Auto-isolate any triggering endpoint.
• ✓
  Audit privileged accounts for credential exposure — Given LSASS dumping in observed chains, rotate all privileged credentials on affected or potentially affected endpoints. Prioritize Domain Admins, Service Accounts, and PAM-managed accounts.
• ✓
  Implement Credential Guard — Enable Windows Credential Guard on all enterprise endpoints to isolate LSASS in a virtualization-based security context, preventing credential dumping even post-exploitation.
• ✓
  Restrict local user login rights — For the two unpatched variants (RedSun, UnDefend), the primary risk mitigation is ensuring attackers cannot achieve initial local user access. Review and restrict RDP access, enforce MFA, and audit local administrator accounts.
• ✓
  Deploy supplementary EDR layer — Organizations relying solely on Windows Defender should urgently deploy a complementary EDR solution (CrowdStrike Falcon, SentinelOne, or equivalent) with kernel-level visibility to detect the unpatched variants.
• ✓
  Block the IOCs at perimeter and endpoint — Import all SHA-256 hashes, file paths, and registry IOCs listed above into your EDR platform, NGFW, and proxy deny-lists immediately.

The following platform-specific queries are ready for immediate deployment. Each query is tuned to minimize false positives while maintaining high detection fidelity for this specific exploit chain.