Registry hive mounted into HKEY_USERS Classes root under mismatched SID (LegacyHive)

Ethan Andrews@eandrews

•updated Jul 14, 2026•113•0•154

Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.