CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LegacyHive

trend · trend:nightmare-eclipse-legacyhive-profile-registry-hijack-2026-07 single-source

Nightmare Eclipse's Windows profile-initialization abuse technique, published shortly after the July 2026 Patch Tuesday and analysed by LevelBlue SpiderLabs. Not a software vulnerability and carrying no CVE: it edits a helper account's ntuser.dat offline through Microsoft's Registry Offline API to repoint the User Shell Folders Local AppData value into an attacker-created NT Object Manager namespace, uses a batch opportunistic lock on UsrClass.dat to pause deterministically until profile initialization reaches the right point, then forces a profile load via CreateProcessWithLogonW with LOGON_WITH_PROFILE, reaching a third account's profile data without ever holding that account's credentials. Strictly post-compromise: the released proof-of-concept requires a low-privileged session plus a separate helper account's credentials. LevelBlue reproduced the full chain on fully patched Windows with July 2026 updates installed and reports no Microsoft mitigation for the class (LevelBlue SpiderLabs, 2026-07-27).

Coverage
2
1 about it · 1 mention · first 2026-07-29 → last 2026-10-21
Latest activity
2026-08-12
LevelBlue reproduces Nightmare Eclipse's latest Windows PoC on a July-2026-patched build, no CVE, no fix, and…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance, healthcare · regions: europe
Sources cited
11
9 hosts

Defender insights

What each entry about LegacyHive tells a defender to do, newest first.

2026-07-29NOTABLELevelBlue reproduces Nightmare Eclipse's latest Windows PoC on a July-2026-patched build, no CVE, no fix, and the abuse uses only legitimate APIs

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

exploited by

Story timeline

Every entry that names LegacyHive, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-08-12ShieldBreak: a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
    mentiontrending-vulnerabilitiesMicrosoft has now shipped an engine fix (1.1.26080.3), and the same researcher claims a partial bypass of it
  2. 2026-07-29LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems
    researchLevelBlue reproduces Nightmare Eclipse's latest Windows PoC on a July-2026-patched build, no CVE, no fix, and the abuse uses only legitimate APIs

Hunting pivots

CVEs
CVE-2026-62832
Affected products
Microsoft Windows
Tags
identitylpeno-patchpatch-availablepoc-publicpriv-escvulnerabilities
ATT&CK techniques (5 across 6 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts
  • ExecutionHijack Execution Flow
  • PersistenceValid Accounts · Modify Registry
  • Privilege EscalationExploitation for Privilege Escalation · Valid Accounts · Abuse Elevation Control Mechanism
  • StealthValid Accounts · Hijack Execution Flow
  • Defense ImpairmentModify Registry

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Execution TA0002

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

T1112Modify Registry×1

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

T1548Abuse Elevation Control Mechanism×1

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

T1574Hijack Execution Flow×1

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Defense Impairment TA0112

T1112Modify Registry×1

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Entries about LegacyHive (1)

2026-07-29 · view entry permalink →

NOTABLECVE-2026-62832updatedNATOB2

LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems

LevelBlue is explicit that LegacyHive is not a traditional vulnerability, like the rest of the Nightmare Eclipse series it explores a corner of Windows rather than introducing a bug, in this case profile initialisation and registry hive loading (LevelBlue SpiderLabs, 2026-07-27). The chain runs in seven steps and every one uses documented, legitimate machinery. It first creates a directory hierarchy inside the NT Object Manager namespace via NtCreateDirectoryObjectEx called from user mode, which LevelBlue notes is itself unusual because normal applications almost never create Object Manager namespaces after system initialisation, then builds native Object Manager symbolic links inside it with NtCreateSymbolicLinkObject (not Windows shortcuts or NTFS junctions) to form the redirection layer (LevelBlue SpiderLabs, 2026-07-27). It then opens a helper account's ntuser.dat directly and edits it offline through Microsoft's Registry Offline API, replacing the Local AppData value under Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders with the redirected namespace path, before saving the hive back over the original (LevelBlue SpiderLabs, 2026-07-27).

The timing step is what makes it reliable rather than racy. Instead of retrying until it wins, the exploit takes a batch opportunistic lock on UsrClass.dat, which pauses execution until profile initialisation reaches the expected point; LevelBlue's framing is that the exploit does not fight the Windows startup process but uses Windows' own synchronisation features to control it (LevelBlue SpiderLabs, 2026-07-27). It then launches a process as the helper user via CreateProcessWithLogonW with LOGON_WITH_PROFILE (the point being not execution but forcing a normal profile load that consumes the tampered hive) and validates success through RegOpenUserClassesRoot. Cleanup removes temporary files but leaves the modified registry configuration and namespace redirection in place, so the persistence lives in on-disk state rather than in a process or scheduled task (LevelBlue SpiderLabs, 2026-07-27).

Two facts bound how much this should worry a defender, in opposite directions. Downward: the released proof-of-concept requires the attacker to control a low-privileged account and hold valid credentials for a separate helper account on the same machine, which LevelBlue says makes it more useful as a post-compromise capability than a standalone attack, and notes those limitations were intentionally introduced before publication to discourage immediate abuse (LevelBlue SpiderLabs, 2026-07-27). This is not remote, not pre-authentication, and not privilege escalation from nothing. Upward: what the attacker does not need is the credentials of the account whose profile data they end up reaching (that is the whole point of the technique) and LevelBlue's teams reproduced the complete chain on fully patched Windows with July 2026 updates installed, with no Microsoft mitigation existing for this class of abuse (LevelBlue SpiderLabs, 2026-07-27). LevelBlue also cautions that the published code demonstrates the technique rather than exhausting it, and expects variants to change how profile loading is triggered or which hives are targeted while relying on the same building blocks.

Triage: every individual operation here is legitimate (offline hive editing, an oplock on a profile hive, a logon-with-profile process launch) and LevelBlue's explicit position is that each is legitimate in isolation while observing them together in a short window is highly unusual and well suited to behavioural correlation. Note specifically that the target executable carries no discriminating value: LevelBlue demonstrates the PoC's notepad.exe is trivially substitutable, so detection must anchor on the calling pattern (a cross-account CreateProcessWithLogonW using LOGON_WITH_PROFILE, routed through the seclogon service) rather than on any process name.

As released, it requires control of a low-privileged account and the credentials of a separate helper account, making it more useful as a post-compromise capability than as a standalone attack. According to the disclosure, these limitations were intentionally introduced before publication to discourage immediate abuse.

the registry modification itself is legitimate. LegacyHive uses valid registry structures, valid APIs, and a valid registry value type. The abuse happens because Local AppData no longer points to the user's normal profile directory. Instead, it points into the attacker-controlled Object Manager namespace.

For EDR platforms with visibility into native Windows APIs, the strongest signals are user-mode invocations of NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject. These functions are rarely used outside system components, debugging tools, or specialized research utilities. Seeing both from the same process should immediately warrant investigation.

LevelBlue OpsIntel CTI and Threat Operations and Research (THOR) teams reviewed and reproduced the complete LegacyHive exploitation chain on fully patched Windows systems with the July 2026 Patch Tuesday updates installed, confirming the PoC functions as described.

LevelBlue SpiderLabs 2026-07-27

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Microsoft Security Response Center 2026-08-11

the advisory is a solid match for Nightmare Eclipse’s description of LegacyHive

Rapid7 2026-08-11
Updaterun 2026-08-12T0411Z-intelcvesevidenceregionssectorssourcestagstechniquesbody

The entry on LegacyHive (the Nightmare Eclipse Windows proof-of-concept that LevelBlue reproduced on a fully patched July-2026 build) recorded that the vendor offered no mitigation for that class of abuse. Microsoft's August Patch Tuesday appears to have closed it. CVE-2026-62832 is described in Microsoft's own record as "Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally", scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated Important, recorded as publicly disclosed before the fix, not exploited, and assessed as "Exploitation More Likely" (MSRC, 2026-08-11).

Microsoft does not name LegacyHive, and the identification is worth attributing precisely rather than assuming. Rapid7 states that between the public disclosure and the advisory FAQ (which describes an authenticated attacker who has credentials for another account and loads another user's registry hive) "the advisory is a solid match for Nightmare Eclipse's description of LegacyHive" (Rapid7, 2026-08-11). That is an assessment by a third party, not a vendor mapping, which is why this entry carries it as such.

The independent detail that makes the match credible comes from the unofficial patch that preceded the official one. 0patch analysed the flaw in July and describes it in the same terms: the vulnerability lies in the Windows User Profile Service, where a time-of-check-to-time-of-use condition lets a local attacker use a symbolic link to confuse the service into loading any user's registry hive instead of the requesting user's, ending up mounted in the attacker's own registry space with read/write permissions. Its root cause, per 0patch, is an access-check fallback: when the service can open the hive file with full access it mounts it under the requesting user's identity using NtLoadKey3, which supports impersonation, but when it cannot, it falls back to the older NtLoadKeyEx without impersonation, so the hive loads with full access as Local System. The consequence 0patch names is the same one the original entry described from the attacker's side: read the target user's stored secrets, or replace paths to trusted executables and DLLs so they run the next time that user logs in (0patch, 2026-07-20).

For anyone who acted on the July coverage, the practical delta is short. The prerequisite is unchanged and still limits the blast radius; the attacker needs a local session plus credentials for a separate account, so this is a post-compromise escalation step rather than an entry point. The August cumulative update supersedes the 0patch micropatch as the remediation, and estates that deployed the community patch were covered in the interval. No action item ships with this entry: the fix arrives inside the ordinary Patch Tuesday cycle, and the entry exists to correct the record on the earlier "no fix available" framing rather than to open new work.

research29 Jul 05:40Zsingle-sourceOpen finding →
Sources: LevelBlue SpiderLabs · Microsoft Security Response Center · Rapid7 · 0patch (ACROS Security)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research1
  • Vulns1

Source distribution

  • levelblue.com2 (18%)
  • msrc.microsoft.com2 (18%)
  • 0patch.com1 (9%)
  • cert.ssi.gouv.fr1 (9%)
  • cyberkendra.com1 (9%)
  • github.com1 (9%)
  • rapid7.com1 (9%)
  • security-hub.ncsc.admin.ch1 (9%)
  • other1 (9%)
All cited sources (11)