LegacyHive: Windows User Profile Service Arbitrary Hive Load EoP Analysis & Detection

---
title: LegacyHive - Suspicious Modification of ProfileImagePath
id: 8a4b9c12-3d4e-4f8a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects modifications to ProfileList registry keys which may indicate an attempt to exploit arbitrary hive loading vulnerabilities like LegacyHive.
references:
  - https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html
author: Security Arsenal
date: 2026/07/09
tags:
  - attack.privilege_escalation
  - attack.t1548.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'
    TargetObject|contains: 'ProfileImagePath'
  filter_standard:
    Image|endswith:
      - '\services.exe'
      - '\svchost.exe'
      - '\mmc.exe'
      - '\procexp.exe'
      - '\procexp64.exe'
  condition: selection and not filter_standard
falsepositives:
  - Legitimate administrative profile management using non-standard tools
level: high
---
title: LegacyHive - ProfSvc Accessing Suspicious File Locations
id: 9b5c0d23-4e5f-5a9b-0c2d-3e4f5a6b7c8d
status: experimental
description: Detects the Windows User Profile Service (ProfSvc) accessing registry hive files outside of standard system or user profile directories, a potential indicator of arbitrary hive loading.
references:
  - https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html
author: Security Arsenal
date: 2026/07/09
tags:
  - attack.privilege_escalation
  - attack.t1548.002
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith: '\profsvc.dll'
    TargetFilename|contains: '.dat'
  filter_legit_paths:
    TargetFilename|contains:
      - '\Users\'
      - '\Windows\System32\config\'
  condition: selection and not filter_legit_paths
falsepositives:
  - Rare; legitimate profile loads should occur within standard user directories
level: critical

// Hunt for modifications to ProfileList keys that may indicate LegacyHive activity
DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where TargetObject contains @"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
| where TargetObject contains @"ProfileImagePath"
| where not (InitiatingProcessFileName in~ ("services.exe", "svchost.exe", "mmc.exe", "procexp.exe"))
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, TargetObject, RegistryValueData
| order by Timestamp desc

-- Hunt for recent modifications to ProfileList registry keys
SELECT 
  Timestamp, 
  Sys.pathname AS KeyPath, 
  Sys.name AS ValueName, 
  Sys.data AS ValueData,
  basename(Sys.pathname) AS SID
FROM read_reg_key(globs="*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\*")
WHERE KeyPath =~ "ProfileList"
  AND Timestamp < now() - 24h
-- Detect changes in the last 24 hours

<#
.SYNOPSIS
    Audit script for LegacyHive vulnerability indicators.
    Checks the ProfileList registry keys for suspicious ProfileImagePath values.
#>

function Test-LegacyHiveIndicators {
    $regPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
    $suspiciousPaths = @("\Users\Public", "\Temp", "\AppData\Local\Temp")
    
    Write-Host "[+] Auditing User Profile Service ProfileList for anomalies..." -ForegroundColor Cyan
    
    $profiles = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
    
    if (-not $profiles) {
        Write-Host "[-] No profiles found or registry access denied." -ForegroundColor Red
        return
    }

    foreach ($profile in $profiles) {
        $sid = $profile.PSChildName
        $profileImagePath = (Get-ItemProperty -Path $profile.PSPath -Name "ProfileImagePath" -ErrorAction SilentlyContinue).ProfileImagePath
        
        if ($profileImagePath) {
            # Check if ProfileImagePath points to non-standard locations
            $isSuspicious = $false
            foreach ($badPath in $suspiciousPaths) {
                if ($profileImagePath -like "*$badPath*") {
                    $isSuspicious = $true
                }
            }

            if ($isSuspicious) {
                Write-Host "[!] SUSPICIOUS PROFILE FOUND: SID $sid" -ForegroundColor Red
                Write-Host "    Path: $profileImagePath" -ForegroundColor Yellow
            } else {
                Write-Host "[+] OK: SID $sid -> $profileImagePath" -ForegroundColor Green
            }
        }
    }
}

Test-LegacyHiveIndicators