LegacyHive - SecLogon TEMP Profile Fallback ( correlation )
correlates two OS-generated artifacts on the same PID within a 120-second window: a seclogon-spawned process (CreateProcessWithLogonW is the only unprivileged API for remote profile loading) and a PostBootReminders\ProfileError\TempProfile registry write (ProfSvc marks fallback when tampered ntuser.dat breaks normal initialization). neither artifact is attacker-controlled. the time window filters PID-reuse false positives. an attacker could theoretically delay the oplock release beyond the window, so a secondary hunting query without the time filter should be run periodically.
Cortex XDR
