LegacyHive Zero-Day: Detecting and Mitigating Windows ProfSvc Privilege Escalation

---
title: LegacyHive - Suspicious Child Process of ProfSvc
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential exploitation of LegacyHive or similar ProfSvc vulnerabilities by identifying unusual child processes spawned by the User Profile Service.
references:
  - https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\profsvc.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Unknown (ProfSvc should not spawn shells)
level: critical
---
title: LegacyHive - ProfSvc Accessing Suspicious File Paths
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects ProfSvc accessing files outside of standard profile directories, which may indicate an attempt to load a malicious hive or DLL.
references:
  - https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith: '\profsvc.exe'
    TargetFileName|contains:
      - '\\Temp\'
      - '\\Public\'
      - '\\Downloads\'
  filter:
    TargetFileName|contains: 'C:\\Users\\'
  condition: selection and not filter
falsepositives:
  - Legitimate profile management scripts (rare)
level: high

// Hunt for suspicious child processes spawned by profsvc.exe
DeviceProcessEvents
| where InitiatingProcessFileName =~ "profsvc.exe"
| where not(FolderPath has @"C:\Windows\System32\") // Exclude legit system binaries if any, though usually profsvc spawns nothing interactive
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for processes spawned by profsvc.exe (LegacyHive indicator)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "profsvc.exe"
  AND Name NOT IN ("conhost.exe")

<#
.SYNOPSIS
    Audit and Harden against LegacyHive (ProfSvc LPE).
.DESCRIPTION
    Checks the status of ProfSvc and hunts for suspicious child processes.
#>

Write-Host "[+] Starting LegacyHive Audit and Hardening Check..." -ForegroundColor Cyan

# 1. Check ProfSvc Status
$profSvc = Get-Service -Name ProfSvc -ErrorAction SilentlyContinue
if ($profSvc) {
    Write-Host "[INFO] User Profile Service Status: $($profSvc.Status)" -ForegroundColor Green
} else {
    Write-Host "[WARN] Could not retrieve ProfSvc status." -ForegroundColor Yellow
}

# 2. Hunt for Suspicious Child Processes
Write-Host "[+] Checking for processes spawned by profsvc.exe..." -ForegroundColor Cyan
$suspiciousProcesses = Get-WmiObject Win32_Process | Where-Object { 
    $_.ParentProcessId -ne 0 -and 
    (Get-WmiObject Win32_Process -Filter "ProcessId = $($_.ParentProcessId)").Name -eq 'profsvc.exe'
}

if ($suspiciousProcesses) {
    Write-Host "[ALERT] Found potential exploit activity! ProfSvc spawned child processes:" -ForegroundColor Red
    $suspiciousProcesses | Format-Table Name, ProcessId, ParentProcessId, CommandLine -AutoSize
    
    # Optional: Kill process (Use with caution in production)
    # $suspiciousProcesses | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
} else {
    Write-Host "[INFO] No suspicious child processes detected." -ForegroundColor Green
}

# 3. Mitigation: Local Admin Audit
Write-Host "[+] Auditing Local Administrators (Defense in Depth)..." -ForegroundColor Cyan
$localAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
if ($localAdmins) {
    Write-Host "[INFO] Current Local Administrators (Ensure these are authorized):" -ForegroundColor Yellow
    $localAdmins | Select-Object Name, PrincipalSource
} else {
    Write-Host "[WARN] Could not enumerate local admins." -ForegroundColor Yellow
}

Write-Host "[+] Audit complete." -ForegroundColor Cyan