LegacyHive PoC execution triggering arbitrary hive loading

Ethan Andrews@eandrews

•updated Jul 14, 2026•153•0•281

Detects execution of the LegacyHive proof-of-concept (PoC) binary or its unique command-line indicators. LegacyHive exploits a Windows User Profile Service vulnerability to perform arbitrary registry hive loading, which can be utilized for privilege escalation.