LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned) — Threadlinqs Intelligence
As of 2026-07-18, LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of Privilege (No CVE Assigned) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1502 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
Researcher Nightmare-Eclipse (aka Chaotic Eclipse) publicly released "LegacyHive," a proof-of-concept exploit abusing the Windows User Profile Service (ProfSvc) to let a standard user mount another
On 14-15 July 2026, hours after Microsoft's July Patch Tuesday, researcher Nightmare-Eclipse released a public GitHub proof-of-concept named LegacyHive targeting the Windows User Profile Service (profsvc.dll / ProfSvc), the SYSTEM-integrity service responsible for loading a user's registry hive (NTUSER.DAT / UsrClass.dat) at logon. The disclosed technique coerces ProfSvc into loading an attacker-influenced registry hive path, resulting in the target user's UsrClass.dat hive being mounted under the current (attacker) user's HKEY_CLASSES_ROOT. Because HKEY_CLASSES_ROOT governs file-type associations, COM/shell extension registration, and program invocation, an attacker who can mount another (potentially administrator) user's hive gains a powerful primitive: they can read sensitive forensic/application artifacts from that user's profile and, per researcher Will Dormann, modify file-association and COM entries so that when the victim administrator interacts with the system (e.g., opening a file type), attacker-controlled code executes with elevated privileges. Dormann's own demonstration reassociated .txt files to open with calc.exe as a proof of concept for what is trivially extensible to a fully weaponized, no-interaction persistence mechanism.
Technically, community threat-hunting analysis (Kevin Beaumont / Gossi The Dog) of the exploitation chain identifies three concrete sub-behaviors that detection engineering can target: (1) staging of registry hive files (ntuser.dat, usrclass.dat) inside temporary GUID-named directories at the system drive root — a LegacyHive-specific staging technique; (2) redirection of "User Shell Folders" registry values (Local AppData, AppData, Cache, Cookies, History under Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) away from physical disk paths toward NT device namespace paths such as \\.\globalroot and \BaseNamedObjects, abusing Windows' object-manager namespace to trick ProfSvc into resolving an attacker-controlled hive; and (3) anomalous loading of offreg.dll (the Windows Offline Registry Library) by processes other than the small set of legitimate System32/SysWOW64/WinSxS/Defender binaries that normally use it — a strong masquerading/defense-evasion signal since offreg.dll use outside those trusted paths is highly atypical.
The publicly released PoC is deliberately crippled relative to the original: it requires (1) code execution as a standard user, (2) valid credentials for a second standard user account, and (3) the username of a third target account (which can be an administrator), and it is hard-restricted to the usrclass.dat hive. Nightmare-Eclipse has stated the original, unreleased exploit required no additional credentials and was not limited to any single hive — any registry hive could reportedly be loaded, a materially more severe primitive than what was published. Independent researcher Kevin Beaumont verified the PoC functions and is unpatched, and published a three-part Microsoft Defender for Endpoint (MDE) Advanced Hunting (KQL) detection rule set covering DeviceFileEvents (GUID staging), DeviceRegistryEvents (User Shell Folders redirection to device paths), and DeviceImageLoadEvents (anomalous offreg.dll loads) designed to catch exploitation attempts even against modified/weaponized variants.
The flaw affects "all supported Windows desktop and server versions," and critically was confirmed to still function after installing the July 2026 Patch Tuesday cumulative updates, meaning routine patching does not remediate it. As of the HKCERT/GovCERT.HK High Threat Security Alert (A26-07-26, 16 July 2026), no CVE identifier, affected-version enumeration, or vendor patch has been published; Microsoft's public statement is that it is "actively investigating the validity and potential applicability of these claims." Microsoft has separately signaled prior displeasure with Nightmare-Eclipse's disclosure pattern, previously warning of possible legal action over wh
Weaknesses (CWE)
CWE-269, CWE-668
Target sectors: government administration, finance, health, technology, education, critical-infrastructure, managed-service-providers
Target regions: Global, North America, Europe, Asia-Pacific, hong kong
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1068, T1548, T1546.001, T1547, T1574.012, T1112, T1564, T1036, T1552, T1552.002
