T1068 — Exploitation for Privilege Escalation - LegacyHive User Hive Manipulation
This detection query hits on the main activity of NightMare Eclipse's LegacyHive exploit: Placing both the ntuser.dat and UsrClass.dat offline hive files in a folder path matching the pattern C:\<GUID>. This is part of the overall exploit chain, which leverages symlinks and oplocks, to trick the Windows OS into loading a target user's UsrClass.dat. One should never expect to see either of these files in a folder patch like C:\<GUID>, so identifying these files touching this path is an immediate cause for concern.
Microsoft Sentinel (KQL)
