LegacyHive - GUID-Named Staging Directory at Filesystem Root

Georg Lauenstein@gsec

•updated Jul 17, 2026•23•0•136

Detects creation of a GUID-named directory directly at the filesystem root (e.g. C:\{8-4-4-4-12 UUID}). LegacyHive creates this world-writable staging directory to hold a modified ntuser.dat hive and to anchor the NT object directory symbolic link chain used in the privilege escalation. The directory is created with an Everyone:GENERIC_ALL DACL and is removed during cleanup, giving it a short-lived footprint. Requires Sysmon Event ID 11 or equivalent file telemetry.