Malware

LegacyHive

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

атакующему заранее понадобится получить локальный доступ, узнать учетные данные обычного пользователя, а также имя учетной записи, которая может принадлежать администратору

Execution

2 techniques

T1574Hijack Execution FlowEvidence1

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

T1574.001DLLEvidence1

For example, as a novelty, we can associate .txt files to open with calc.exe," Dormann noted.

Persistence

5 techniques

T1078Valid AccountsEvidence1

T1112Modify RegistryEvidence5

Dormann showed that a non-admin could, for example, change the .txt file association in the admin’s hive to launch calc.exe instead of a text editor

T1546Event Triggered ExecutionEvidence2

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

T1546.015Component Object Model HijackingEvidence2

an attacker can overwrite COM objects or shell extensions that load automatically when the administrator logs in, turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

T1547Boot or Logon Autostart ExecutionEvidence1

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

Privilege Escalation

7 techniques

T1068Exploitation for Privilege EscalationEvidence4

A Windows zero-day vulnerability, dubbed LegacyHive (MSNightmare), abuses the User Profile Service to enable local privilege escalation, tampering with administrator accounts, and admin-level code execution.

T1078Valid AccountsEvidence1

T1134Access Token ManipulationEvidence1

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

T1546Event Triggered ExecutionEvidence2

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

T1546.015Component Object Model HijackingEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

T1548Abuse Elevation Control MechanismEvidence1

The GitHub repository describes LegacyHive as a “Windows user profile service arbitrary hive load elevation of privileges vulnerability.”

Stealth

4 techniques

T1078Valid AccountsEvidence1

T1134Access Token ManipulationEvidence1

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

T1574Hijack Execution FlowEvidence1

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

T1574.001DLLEvidence1

For example, as a novelty, we can associate .txt files to open with calc.exe," Dormann noted.

Defense Impairment

1 technique

T1112Modify RegistryEvidence5

Dormann showed that a non-admin could, for example, change the .txt file association in the admin’s hive to launch calc.exe instead of a text editor

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Jul 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

A proof-of-concept exploit targeting the Windows User Profile Service (ProfSvc) to achieve local privilege escalation by loading a target user's registry hive into the current user classes root.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

LegacyHive

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Execution

2 techniques

T1574Hijack Execution FlowEvidence1

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

T1574.001DLLEvidence1

For example, as a novelty, we can associate .txt files to open with calc.exe," Dormann noted.

Persistence

5 techniques

T1078Valid AccountsEvidence1

T1112Modify RegistryEvidence5

Dormann showed that a non-admin could, for example, change the .txt file association in the admin’s hive to launch calc.exe instead of a text editor

T1546Event Triggered ExecutionEvidence2

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

T1546.015Component Object Model HijackingEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

Privilege Escalation

7 techniques

T1068Exploitation for Privilege EscalationEvidence4

T1078Valid AccountsEvidence1

T1134Access Token ManipulationEvidence1

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

T1546Event Triggered ExecutionEvidence2

successful exploitation would allow non-admin users to modify the classes registry hive and gain automatic code execution when the admin account logs into a compromised system.

T1546.015Component Object Model HijackingEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

turning the hijacked hive into a persistence and code-execution mechanism that runs with admin privileges during a normal sign-in.

T1548Abuse Elevation Control MechanismEvidence1

The GitHub repository describes LegacyHive as a “Windows user profile service arbitrary hive load elevation of privileges vulnerability.”

Stealth

4 techniques

T1078Valid AccountsEvidence1

T1134Access Token ManipulationEvidence1

The researcher claims the original exploit did not require additional user credentials and could coerce ProfSvc (and even achieve kernel-level impersonation as NT AUTHORITY\SYSTEM) to load any hive

T1574Hijack Execution FlowEvidence1

a non-admin can modify an admin’s classes registry hive and hijack how that account launches applications or COM objects.

T1574.001DLLEvidence1

For example, as a novelty, we can associate .txt files to open with calc.exe," Dormann noted.

Defense Impairment

1 technique

T1112Modify RegistryEvidence5

Dormann showed that a non-admin could, for example, change the .txt file association in the admin’s hive to launch calc.exe instead of a text editor

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

the hacker newsNews

Jul 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

A proof-of-concept exploit targeting the Windows User Profile Service (ProfSvc) to achieve local privilege escalation by loading a target user's registry hive into the current user classes root.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.