Scope check: defensive post/gather audit module for CVE-2026-33825 (BlueHammer)

[anasabugaddara-ux]

Hi all — I'd like a scope check before I put time into a PR.

I've written a "post/windows/gather" module that runs in an existing session and audits the host for **CVE-2026-33825 (BlueHammer) — the Windows Defender TOCTOU flaw (CWE-1220, currently on CISA KEV). It's read-only triage and answers three questions:

1. Vulnerable? — fingerprints the Defender Antimalware Platform version from multiple sources (Get-MpComputerStatus / registry / file version) and compares against the patched build (4.18.26030.3011), flagging source disagreement.
2. Exposed in practice? — checks posture: Tamper Protection, real-time protection, VSS/shadow-copy state, and signature currency.
3. Targeted? — hunts the Defender Operational event log (1116/1117) and known IOCs for evidence the host was hit.

My question: is a defensive/triage post module like this in scope for the framework, or would you rather it be shaped differently (e.g. folded into an existing "enum_*" module, or generalized)? Happy to adapt before opening a PR.
Repo with the module + Rapid7-format docs: https://github.com/anasabugaddara-ux/defender-bluehammer-audit