LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading — Threadlinqs Intelligence
As of 2026-07-17, LegacyHive: Windows 0-Day Local Privilege Escalation via User Profile Service (ProfSvc) Arbitrary Registry Hive Loading is a high-severity vulnerability threat attributed to NightmareEclipse, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1449 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Attribution: NightmareEclipse · UNKNOWN
Researcher NightmareEclipse (aka Chaotic Eclipse) publicly released LegacyHive, an unpatched Windows zero-day in the User Profile Service (ProfSvc) that lets a low-privileged, authenticated user
LegacyHive is a proof-of-concept privilege-escalation/cross-user-access primitive targeting the Windows User Profile Service (ProfSvc), the core system component responsible for loading and unloading per-user registry hives (NTUSER.DAT and UsrClass.dat) during logon/logoff. The technique chains three mechanisms: (1) offline modification of a secondary account's NTUSER.DAT to repoint the 'Local AppData' User Shell Folders value to an Object Manager path (\\.\GlobalRoot\BaseNamedObjects\Restricted); (2) creation of Object Manager directory objects and symbolic links beneath \BaseNamedObjects\Restricted\{GUID} and \BaseNamedObjects\Restricted\Microsoft that shadow the expected hive path and can be swapped mid-resolution; and (3) a synchronized/raced profile load in which an oplock is placed on a decoy hive to pause ProfSvc's load sequence while CreateProcessWithLogonW is invoked with LOGON_WITH_PROFILE and CREATE_SUSPENDED against a secondary standard-user account, whose profile load is then redirected via the swapped symlink to load the TARGET user's UsrClass.dat instead of the secondary account's own hive. Success is confirmed via RegOpenUserClassesRoot resolving to the target's namespace. The publicly released PoC is deliberately limited by the researcher to require credentials for a second standard (non-admin) helper account and is restricted to read-access mounting of UsrClass.dat only; the researcher states the original, unreleased exploit required no additional credentials and could load ANY registry hive (not just UsrClass.dat), implying a materially more severe unreleased capability. Beyond passive data exposure (application data, Windows Explorer history, forensic artifacts), documented downstream impact includes hijacking file-type associations (e.g., redirecting .txt to launch arbitrary executables such as calc.exe) and modifying COM objects/shell extensions that auto-load during a subsequent administrator logon, providing a path to code execution and persistence with administrative privileges without requiring user interaction beyond a normal admin logon. The flaw is functional against all currently supported Windows 10, Windows 11, and Windows Server (2016, 2019, 2022) editions, including systems fully patched through Microsoft's July 2026 Patch Tuesday (which itself shipped a record 622 fixes). No CVE identifier, Microsoft Security Response Center advisory, or official patch existed at time of disclosure (July 14-15, 2026); Microsoft stated only that it is 'aware of the reported vulnerability and actively investigating,' while reiterating its preference for coordinated vulnerability disclosure. LegacyHive is the researcher's ninth publicly released Windows exploit in roughly three months (following BlueHammer, UnDefend, RedSun, RoguePlanet, YellowKey, GreatXML, GreenPlasma, and MiniPlasma), amid a disclosure dispute with Microsoft dating to at least April 2026; RoguePlanet was quietly patched by Microsoft on July 9, 2026, while BlueHammer and RedSun reportedly progressed from PoC to widespread exploitation within days of release. The researcher is suspected by some analysts of being a disgruntled former Microsoft engineer based on the technical sophistication and internal knowledge reflected in the vulnerability series. Highest-risk environments are multi-user Windows systems: Remote Desktop Session Hosts, Virtual Desktop Infrastructure (VDI), and shared workstations, where standard users routinely share a host with privileged or other users' cached profiles. No patch exists; defenders are directed to detection/monitoring as the primary control, focused on cross-SID hive access, suspended cross-user process creation via CreateProcessWithLogonW, Object Manager symlink creation beneath BaseNamedObjects\Restricted, and anomalous NTUSER.DAT/UsrClass.dat modification timing.
Weaknesses (CWE)
CWE-269, CWE-284, CWE-863, CWE-362
Target sectors: enterprise, government administration, critical-infrastructure, technology, managed-service-providers, education, health, finance
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1592, T1587.004, T1078.003, T1569.002, T1106, T1546.001, T1546.015, T1505, T1068, T1134