LegacyHive Exploitation Chain - ProfSvc Hive Hijack LPE (TOCTOU)
Detects the full LegacyHive local privilege escalation chain (disclosed by Nightmare-Eclipse, July 2026): a TOCTOU race against the Windows User Profile Service (ProfSvc) using GLOBALROOT Object Manager symlinks and an oplock to trick ProfSvc, running as SYSTEM, into loading a different user's UsrClass.dat registry hive than the one it authenticated for. This rule chains 3 stages on the same host within a 15-minute window: (1) a staging copy of UsrClass.dat appearing outside its normal AppData profile path, typically in a randomly named folder off a drive root; (2) an explicit-credential logon (Security 4648) immediately followed by a secondary-logon session (4624, LogonType 2, seclogon/Advapi) consistent with CreateProcessWithLogonW + LOGON_WITH_PROFILE; (3) svchost.exe (ProfSvc) subsequently loading a UsrClass.dat whose profile owner does not match the helper account used in stage 2. Requires Windows Security Event logs (Logon/Logoff auditing for 4648/4624) and Microsoft Defender for Endpoint DeviceFileEvents ingested into the same Sentinel workspace. Known gap: Object Manager symlink creation and oplock placement, the mechanisms that perform the actual redirection, are not natively covered by Security auditing or MDE; consider supplementing with Sysmon/ETW if available. Lab simulation checklist before enabling as high severity: - Run the public PoC (https://github.com/MSNightmare/LegacyHive) against a lab VM with Security auditing (Logon/Logoff, Account Logon) and MDE onboarded. - Confirm Stage 1 fires on the staging UsrClass.dat copy path and folder-name pattern. - Confirm Stage 2's 4648/4624 pairing and LogonProcessName value match your OS build (may differ across Windows 10/11/Server releases). - Confirm Stage 3's InitiatingProcessAccountName attribution for svchost.exe/ProfSvc; if it reports SYSTEM instead of the helper account, replace the ProfileOwner != Helper check with a LogonId/TargetLogonId correlation to Stage 2. - Tune the staging-folder regex ag
Microsoft Sentinel (KQL)
