Microsoft Patches 'LegacyHive' Windows Zero-Day — Detection and Remediation Guide for July 2026 Patch Tuesday

---
title: Registry Hive Export of Credential-Bearing Hives via reg.exe
id: 3f7c2a91-6b48-4d5e-9a01-8c2e5f7d1b34
status: experimental
description: Detects reg.exe save/export operations against SAM, SYSTEM, or SECURITY hives, a technique used to stage credential theft and consistent with abuse patterns surrounding hive-handling vulnerabilities such as LegacyHive.
references:
  - https://attack.mitre.org/techniques/T1003/002/
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-legacyhive-windows-zero-day-vulnerability/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1003.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\reg.exe'
      - '\regedit.exe'
    CommandLine|contains:
      - ' save '
      - ' export '
  selection_hive:
    CommandLine|contains:
      - 'HKLM\SAM'
      - 'HKLM\SYSTEM'
      - 'HKLM\SECURITY'
      - 'HKEY_LOCAL_MACHINE\SAM'
      - 'HKEY_LOCAL_MACHINE\SECURITY'
  condition: selection_img and selection_hive
falsepositives:
  - Legitimate backup or migration tooling performing hive exports (baseline by service account and path)
  - Forensic acquisition workflows
level: high
---
title: Registry Hive Loaded from User-Writable or Temp Path
id: 9d1e4b27-3a6f-4c8d-b502-7f3a9c1e5d68
status: experimental
description: Detects reg.exe load/restore operations or RegLoadKey-style activity sourcing hive files from temp, user profile, or other non-standard paths, consistent with staging a crafted legacy hive to trigger a hive-handling vulnerability such as LegacyHive.
references:
  - https://attack.mitre.org/techniques/T1112/
  - https://attack.mitre.org/techniques/T1003/002/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.t1112
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_verb:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - ' load '
      - ' restore '
  selection_path:
    CommandLine|contains:
      - '\Temp\'
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '$Recycle.Bin'
      - '\Windows\Temp\'
  condition: selection_verb and selection_path
falsepositives:
  - Software deployment tools staging profile hives (rare; baseline by signer and parent process)
level: high
---
title: Hive File Artifacts Written Outside Standard Config Locations
id: 5c8f3d12-7e9a-4b1c-a467-2d6e8b0f3c91
status: experimental
description: Detects creation of files resembling registry hives (SAM, SYSTEM, SECURITY, NTUSER.DAT, or files with hive extensions) outside their standard locations, indicating staging of a crafted or exfiltrated hive file.
references:
  - https://attack.mitre.org/techniques/T1003/002/
  - https://attack.mitre.org/techniques/T1074/001/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.collection
  - attack.t1074.001
  - attack.credential_access
logsource:
  category: file_event
  product: windows
detection:
  selection_name:
    TargetFilename|contains:
      - '\SAM'
      - '\SECURITY'
      - '\SYSTEM'
      - 'NTUSER.DAT'
      - '.hiv'
      - '.dat.sav'
  selection_name_ext:
    TargetFilename|endswith:
      - '.hiv'
      - '.dat.sav'
  filter_standard:
    TargetFilename|contains:
      - '\Windows\System32\config\'
      - '\Windows\System32\config\RegBack\'
      - '\Windows\Repair\'
      - '\System Volume Information\'
  condition: (selection_name or selection_name_ext) and not filter_standard
falsepositives:
  - Backup agents writing hive copies to staging directories (baseline by process)
  - Forensic tooling and IT migration utilities
level: medium

let Lookback = 7d;
let SuspiciousPaths = dynamic(["\\Temp\\", "\\AppData\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\", "$Recycle.Bin"]);
let HiveTargets = dynamic(["HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY", "HKEY_LOCAL_MACHINE\\SAM", "HKEY_LOCAL_MACHINE\\SECURITY"]);
let HiveLoads = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName =~ "reg.exe"
    | where ProcessCommandLine has_any ("load", "restore")
    | where ProcessCommandLine has_any (SuspiciousPaths)
    | project LoadTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, DeviceId;
let HiveSaves = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("reg.exe", "regedit.exe")
    | where ProcessCommandLine has_any ("save", "export")
    | where ProcessCommandLine has_any (HiveTargets)
    | project SaveTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, DeviceId;
union HiveLoads, HiveSaves
| extend InitiatingContext = strcat(InitiatingProcessFileName, " (", InitiatingProcessAccountName, ")")
| summarize arg_max(coalesce(LoadTime, SaveTime), *) by DeviceName, AccountName, ProcessCommandLine
| sort by coalesce(LoadTime, SaveTime) desc

DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any ("SAM", "SECURITY", "SYSTEM", "NTUSER.DAT") or FileName endswith ".hiv"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\Users\\Public\\", "\\ProgramData\\")
| where FolderPath !has "\\System Volume Information\\"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FolderPath, FileName, SHA256
| sort by Timestamp desc

-- LegacyHive hunt: hive staging and manipulation artifacts
-- Looks for reg.exe load/save of hives from suspicious paths and hive file drops
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(load|restore|save|export)'
  AND CommandLine =~ '(?i)(HKLM\\\\SAM|HKLM\\\\SYSTEM|HKLM\\\\SECURITY|HKEY_LOCAL_MACHINE\\\\SAM|HKEY_LOCAL_MACHINE\\\\SECURITY)'
   OR (CommandLine =~ '(?i)(load|restore)'
  AND CommandLine =~ '(?i)(\\\\Temp\\\\|\\\\AppData\\\\|\\\\Users\\\\Public\\\\|\\\\ProgramData\\\\)')

LET staged_hives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/**/*.hiv',
                 'C:/Users/Public/**/*.hiv',
                 'C:/Windows/Temp/**/*.hiv',
                 'C:/ProgramData/**/*.hiv',
                 'C:/Users/*/AppData/**/SAM',
                 'C:/Users/*/AppData/**/SECURITY',
                 'C:/Users/Public/**/NTUSER.DAT*'])
WHERE NOT IsDir

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'FILE_ARTIFACT' AS Name, FullPath AS CommandLine, '' AS Exe, '' AS Username, Mtime AS CreateTime
FROM staged_hives

#Requires -RunAsAdministrator
# LegacyHive remediation & verification — Security Arsenal
# 1) Verify a July 2026 (or later) cumulative update is installed

$cutoff = Get-Date '2026-07-14'
$recentCU = Get-HotFix | Where-Object { $_.InstalledOn -ge $cutoff } |
            Sort-Object InstalledOn -Descending | Select-Object -First 5

if ($recentCU) {
    Write-Host '[+] Post-July-2026 updates found:' -ForegroundColor Green
    $recentCU | Format-Table HotFixID, Description, InstalledOn -AutoSize
} else {
    Write-Host '[-] No updates installed since 2026-07-14. System likely UNPATCHED for LegacyHive.' -ForegroundColor Red
    Write-Host '[*] Triggering Windows Update scan...' -ForegroundColor Yellow
    $wu = (New-Object -ComObject Microsoft.Update.AutoUpdate)
    $wu.DetectNow()
    Start-Process -FilePath 'UsoClient.exe' -ArgumentList 'StartInteractiveScan' -ErrorAction SilentlyContinue
}

# 2) Check for pending reboot (patch not effective until reboot)
$pendingReboot = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
if ($pendingReboot) { Write-Host '[!] REBOOT PENDING — patch is not active until restart.' -ForegroundColor Red }

# 3) Audit: search for hive export/load events in the last 14 days (Sysmon EID 1 or Security 4688)
$auditStart = (Get-Date).AddDays(-14)
$events = Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=$auditStart } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'reg(\.exe|edit\.exe)' -and
                   $_.Message -match '(save|export|load|restore)' -and
                   $_.Message -match '(SAM|SYSTEM|SECURITY)' }
if ($events) {
    Write-Host "[!] $($events.Count) suspicious hive operation(s) in the last 14 days — investigate:" -ForegroundColor Red
    $events | Select-Object TimeCreated, @{n='CmdLine';e={($_.Message -split "`n") -match 'Process Command Line'}} |
        Format-List
} else {
    Write-Host '[+] No suspicious hive export/load events in Security log (or 4688 auditing not enabled).' -ForegroundColor Green
}

# 4) Confirm process creation auditing with command line is enabled (required for the detections above)
$cl = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
if ($cl -ne 1) {
    Write-Host '[!] Command-line auditing disabled. Enabling for detection coverage...' -ForegroundColor Yellow
    New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force | Out-Null
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
}