LegacyHive - User Shell Folders AppData Redirect to Kernel Namespace

Georg Lauenstein@gsec

•updated 5 days ago•0•0•4

Detects modification of HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData to a Windows kernel object namespace path such as \\.\globalroot\BaseNamedObjects\Restricted. The LegacyHive 0-day exploits this registry pivot to redirect UsrClass.dat loading via the Windows User Profile Service, achieving privilege escalation on all supported desktop and server versions with the July 2026 patch applied. No legitimate application redirects a user shell folder to a kernel namespace path.