Detects Nightmare-Eclipse/BlueHammer (FunnyApp), a Windows local privilege escalation PoC that abuses a Defender signatu

Hunt Hypothesis

This detection identifies adversaries exploiting a race condition in Windows Defender’s signature update mechanism to escalate local privileges and exfiltrate the SAM hive for credential harvesting. Proactive hunting is essential because this specific attack vector mimics legitimate system processes, allowing attackers to silently compromise domain credentials before triggering broader alerting mechanisms.

YARA Rule

rule HKTL_BlueHammer_Apr26 {
   meta:
      author = "AzizFarghly (Nextron-Systems)"
      description = "Detects Nightmare-Eclipse/BlueHammer (FunnyApp), a Windows local privilege escalation PoC that abuses a Defender signature-update RPC and a junction/symlink race to leak the SAM hive and derive NTLM hashes - giving an unprivileged user full SYSTEM-level credential access."
      date = "2026-04-07"
      reference = "https://github.com/Nightmare-Eclipse/BlueHammer"
      hash = "6514f56223999eb86a19ea9f2abbfb0f407934a1a0694ffb94a8ea37113073f4"
      hash = "93008c42764b74b759678fd376abd90696f74af408600727b6649286d8424270"
      hash = "b25e903988e530df00658ff3ad6d180e43d6660b705ad6d0def4a29ee1167e52"
      hash = "82eb727e2a2b3334a70fa2d357ba4f44dc989a650a6a18222dd5d1bb1444b496"
      hash = "b33f3f31c83fc655952fab73d72b673b92ed4f205daee56444903201316cfc4a"
      hash = "c6baa5ec9ea2c2802a90acad5a53453d176a02e04a31ac8e9b7b34b5e3329b84"
      hash = "552dba31a446e96416738d84d4366503c397ba508a732719531c89a41abf3704"
      hash = "c9bec499db6a0a2165bcd2a211c8887e5fadf954eb9a2e5d3c6ca833e4a5ef64"
      score = 90
      id = "595bf733-b287-5048-88e2-b88caffc7a5d"
   strings:
      $x1 = "Junction created %ws => %ws"
      $x2 = "connect to windows defender RPC port !!!"

      $s1 = "\\System32\\Config\\SAM" wide
      $s2 = "IMpService77BDAF73-B396-481F-9042-AD358843EC24" wide
      $s3 = "ServerMpUpdateEngineSignature"

      $op1 = { 8D 47 02 66 89 43 0C 66 C7 43 0E 02 00 48 8B C7 48 D1 E8 66 44 89 7C 43 12 }
   condition:
      uint16(0) == 0x5A4D
      and filesize < 7MB
      and (
         1 of ($x*)
         or all of ($s*)
         or $op1
      )
      or 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Nightmare-Eclipse/BlueHammer detection rule, including suggested filters or exclusions:

Scenario: Scheduled Windows Defender Signature Updates via Task Scheduler
- Context: The rule triggers when the wuauserv (Windows Update) service or a scheduled task runs the signature update process (MpCmdRun.exe) during off-hours. If this process creates temporary junction points in %WINDIR%\System32\catroot2 to stage updates, it mimics the race condition behavior of the attack.
- Filter/Exclusion: Exclude processes where ImageName is C:\Program Files\Windows Defender\MpCmdRun.exe AND the parent process is svchost.exe (specifically the Wuauserv service) OR Task Scheduler (SchTasks.exe).
Scenario: Third-Party Endpoint Protection Agents Performing Integrity Checks
- Context: Enterprise EDR solutions like CrowdStrike Falcon, Carbon Black, or SentinelOne often perform deep integrity scans of the SAM hive and Defender signature directories. These agents may create temporary symlinks to map registry hives for analysis, triggering the “symlink race” logic of the detection rule.
- Filter/Exclusion: Exclude events where the ParentImageName contains known EDR executables (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\SentinelOne\Sentinel\sentinel.exe) AND the target path involves %WINDIR%\System32\config.
Scenario: Active Directory Group Policy Client Service Refreshing Local Policies
- Context: During a GPUpdate cycle, the gpsvc service may modify local security policies which involve reading and writing to