Triple Windows Defender Zero-Day: BlueHammer, RedSun & UnDefend

Microsoft Defender's threat remediation engine has become an attack surface. One researcher. Three exploits. Thirteen days. Two still unpatched — and all three confirmed in the wild.

A researcher going by "Chaotic Eclipse" dropped three fully weaponised Windows Defender local privilege escalation exploits in 13 days — CVE-2026-33825 (BlueHammer), RedSun, and UnDefend — all as a deliberate protest against Microsoft's MSRC handling of their reports. Every Windows 10, Windows 11, and Windows Server 2016–2025 endpoint with Defender enabled (virtually all of them) is in scope.

Microsoft patched BlueHammer in the April 14 Patch Tuesday. RedSun and UnDefend remain unpatched, and security firm Huntress confirmed all three exploits were used in live attacks by April 17. Threat actors are already chaining UnDefend (silently killing Defender updates) with RedSun (SYSTEM escalation) before moving laterally.

The Three Vulnerabilities at a Glance

Technical Deep-Dive

Impact Assessment

Microsoft Sentinel KQL Detection Query

This query combines four detection signals: MsMpEng.exe writing PE files to System32 (BlueHammer/RedSun privilege escalation indicator), suspicious CldApi.dll usage from unusual paths (RedSun cloud API abuse), Defender definition update failures (UnDefend indicator), and sudden SYSTEM-process spawns from unprivileged parent processes.

// SecByte Detection: CVE-2026-33825 BlueHammer / RedSun / UnDefend
// Windows Defender Zero-Day Exploitation Indicators
// Microsoft Sentinel | Log Analytics | KQL
// Author: Sujit Mahakhud | secbyte.in | April 21, 2026

let lookback = 24h;

// SIGNAL 1: MsMpEng.exe writing PE/DLL files to System32
// Indicates BlueHammer or RedSun NTFS junction redirect succeeded
let Signal_MsMpEng_SystemWrite =
  DeviceFileEvents
  | where Timestamp > ago(lookback)
  | where InitiatingProcessFileName ==~ "MsMpEng.exe"
  | where ActionType in ("FileCreated", "FileModified")
  | where FolderPath startswith @"C:\Windows\System32"
  | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".sys"
  // Exclude known-good Defender self-updates
  | where FolderPath !contains "Windows Defender"
  | where FolderPath !contains "MpSigStub"
  | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName,
    Signal="MsMpEng_System32_Write";

// SIGNAL 2: Suspicious CldApi.dll load from non-system paths
// RedSun cloud rollback abuse
let Signal_CldApi_Abuse =
  DeviceImageLoadEvents
  | where Timestamp > ago(lookback)
  | where FileName ==~ "CldApi.dll"
  | where InitiatingProcessFolderPath has_any(@"\Temp\", @"\AppData\", @"\Downloads\", @"\Public\")
  | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
    InitiatingProcessAccountName, Signal="CldApi_Suspicious_Load";

// SIGNAL 3: Defender definition update failures (UnDefend indicator)
// Repeated update failures suggest active suppression
let Signal_DefenderUpdateFail =
  SecurityEvent
  | where TimeGenerated > ago(lookback)
  | where EventID in (2001, 2003, 2004)
  | summarize FailureCount=count() by Computer, bin(TimeGenerated, 1h)
  | where FailureCount >= 3
  | project Timestamp=TimeGenerated, DeviceName=Computer, FailureCount,
    Signal="Defender_UpdateSuppressed";

// SIGNAL 4: Low-priv process spawning SYSTEM child
// Post-exploitation: unprivileged parent -> SYSTEM shell
let Signal_PrivEsc =
  DeviceProcessEvents
  | where Timestamp > ago(lookback)
  | where AccountName ==~ "SYSTEM"
      and InitiatingProcessAccountName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
  | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
  | project Timestamp, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessAccountName, Signal="Unprivileged_To_SYSTEM_Shell";

// COMBINE ALL SIGNALS
Signal_MsMpEng_SystemWrite
| union Signal_CldApi_Abuse, Signal_DefenderUpdateFail, Signal_PrivEsc
| summarize Signals=make_set(Signal), EventCount=count() by DeviceName, bin(Timestamp, 1h)
| extend Severity = iff(array_length(Signals) >= 2, "HIGH - Multiple Signals", "MEDIUM - Single Signal")
| order by array_length(Signals) desc, Timestamp desc

Requires Microsoft Defender for Endpoint (MDE) telemetry via DeviceFileEvents, DeviceImageLoadEvents, DeviceProcessEvents, and Windows Security Event logs.

Mitigation & Recommendations

References