BlueHammer abuses Windows Defender's update process to gain SYSTEM access