LegacyHive Zero-Day: Detecting and Mitigating the Unpatched Windows Privilege Escalation Vulnerability

---
title: LegacyHive - Suspicious Access to Protected Registry Hives
id: 8a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789
status: experimental
description: Detects attempts by non-system processes to access or modify sensitive registry hive files (SAM, SYSTEM, SECURITY) which may indicate exploitation of LegacyHive or similar LPEs.
references:
  - Internal Research
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1004
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\config\SAM'
      - '\config\SYSTEM'
      - '\config\SECURITY'
  filter:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter
falsepositives:
  - Legitimate backup software accessing hives
  - Administrative tools (rare from non-admin users)
level: high
---
title: LegacyHive - Anomalous Registry Key Modifications for Persistence
id: 9b2c3d4e-5f6a-7890-1b2c-3d4e5f67890a
status: experimental
description: Detects modifications to Run keys or Services via processes that are not typically associated with administration, potentially a post-exploitation action after LegacyHive escalation.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.privilege_escalation
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_target:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\System\CurrentControlSet\Services'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
  filter_admin:
    SubjectUserName|contains:
      - 'Administrator'
      - 'SYSTEM'
  condition: selection_target and selection_image and not filter_admin
falsepositives:
  - Legitimate software installation by users (rare)
level: medium

// Hunt for suspicious access to Registry Hive configurations
DeviceFileEvents
| where Timestamp > ago(1d)
| where TargetFileName has @"C:\Windows\System32\config\" 
| where TargetFileName has_any ("SAM", "SYSTEM", "SECURITY", "DEFAULT")
| where InitiatingProcessAccountName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "ADMINISTRATOR", "DOMAIN ADMINS")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, TargetFileName, ActionType
| order by Timestamp desc

-- Hunt for handles to sensitive registry hives
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Exe =~ 'services.exe' 
   OR Exe =~ 'lsass.exe'

-- Check for weak permissions on hive files
SELECT FullPath, Mode, Size, Mtime
FROM glob(globs="C:/Windows/System32/config/SAM")

-- Monitor for recent modifications to registry hives
SELECT FullPath, Mtime, Size
FROM glob(globs="C:/Windows/System32/config/*")
WHERE Mtime > now() - 24h

# LegacyHive Mitigation Script
# Audit and harden ACLs on Registry Hive Files

Write-Host "Starting mitigation for LegacyHive exposure..." -ForegroundColor Cyan

$hivePath = "$env:SystemRoot\System32\config"
$sensitiveHives = @("SAM", "SYSTEM", "SECURITY", "SOFTWARE")

foreach ($hive in $sensitiveHives) {
    $filePath = Join-Path $hivePath $hive
    if (Test-Path $filePath) {
        Write-Host "Checking ACL for $filePath..." -ForegroundColor Yellow
        
        # Get current ACL
        $acl = Get-Acl -Path $filePath
        
        # Check for non-standard access (simplified check)
        # In a real scenario, compare against a known good state
        $accessToString = $acl.AccessToString
        
        if ($accessToString -like "*BUILTIN\Users*" -or $accessToString -like "*NT AUTHORITY\Authenticated Users*{") {
            Write-Host "WARNING: Weak permissions detected on $hive." -ForegroundColor Red
            Write-Host "Reviewing Access Control List..."
            $acl.Access
        } else {
            Write-Host "Permissions appear restricted." -ForegroundColor Green
        }
    }
}

Write-Host "Mitigation script complete. Please review any warnings." -ForegroundColor Cyan