@nyanbinary @wdormann
It picked the wrong update. It downloaded the platform update instead of the patterns

Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.26020.6) - Current Channel (Broad)

It works with this:

Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.447.233.0) - Current Channel (Broad)

@nyanbinary @wdormann
I encountered the same problem. Had to revert my VM snapshot so defender wasn't up-to-date.
ServerMpUpdateEngineSignature ALPC call ended unexpectedly, RPC_STATUS : 0x8050A003
-> ERROR_MP_BADDB_OLDENGINE
I think when this happens the downloaded version isn't newer (or even older) than the installed version.
Nightmare-Eclipse even added a comment, see line 282 https://github.com/Nightmare-Eclipse/BlueHammer/blob/main/FunnyApp.cpp

Windows Defender now flags and blocks FunnyApp.exe (they added the signature).

@wdormann @tiraniddo
Iirc Aaron Margosis complained about Defender writing it's updates to user write-able directories years ago. Another question is why they don't enable the redirection trust policy for the process (I think that would remediate the issue)

There is now a blog post.
https://medium.com/@taylorsmithgg/et-tu-defender-bluehammer-turns-windows-defender-against-you-666328724ec4