Full Report
Following GreenPlasma, YellowKey and MiniPlasma, as well as RoguePlanet and GreatXML, the Nightmare-Eclipse disclosure actor has published LegacyHive, its latest Windows proof-of-concept (PoC) released shortly after Microsoft's July 2026 Patch Tuesday.
Analysis Summary
# Tool/Technique: LegacyHive
## Overview
LegacyHive is a post-exploitation proof-of-concept (PoC) tool released by the threat actor **Nightmare-Eclipse**. It demonstrates a method for local privilege escalation and cross-user data access by abusing the Windows profile initialization process. Unlike traditional buffer overflows, LegacyHive utilizes "offline registry manipulation" and NT Object Manager symbolic links to redirect application file requests (such as Local AppData) to a target user's sensitive registry hives and files.
## Technical Details
- **Type**: Tool / Exploit PoC
- **Platform**: Windows (Confirmed functional on fully patched July 2026 systems)
- **Capabilities**: Local Privilege Escalation (LPE), Credential/Data Access via profile redirection
- **First Seen**: July 27, 2026 (Published shortly after Microsoft’s July 2026 Patch Tuesday)
## MITRE ATT&CK Mapping
- **[TA0004 - Privilege Escalation]**
- **[T1574 - Hijack Execution Flow]**
- **[TA0006 - Credential Access]**
- **[T1003 - OS Credential Dumping]**
- **[TA0005 - Defense Evasion]**
- **[T1006 - Direct Volume Access]** (Offline registry manipulation)
- **[T1106 - Native API]** (Use of `NtCreateDirectoryObjectEx` and `Offreg.dll`)
## Functionality
### Core Capabilities
- **NT Object Manager Namespace Creation**: Dynamically resolves `NtCreateDirectoryObjectEx` to create a custom, hidden directory structure under `\BaseNamedObjects\Restricted\`.
- **Symbolic Link Redirection**: Creates Object Manager symbolic links to redirect Windows path resolution at a low level, bypassing standard Win32 API restrictions.
- **Offline Registry Manipulation**: Utilizes the Offline Registry Library (`Offreg.dll`) to modify a user's `ntuser.dat` hive while it is not loaded, changing environment variables like `LOCALAPPDATA`.
### Advanced Features
- **Profile Initialization Abuse**: Triggered when a "helper" account (for which the attacker has credentials) logs in. Windows processes the maliciously crafted hive, causing applications (like Notepad) to follow the redirected paths into a target user's (e.g., Administrator) directory.
- **Oplock Synchronization**: Uses batch opportunistic locks (oplocks) to stabilize the exploitation window during the login/hive-loading process.
## Indicators of Compromise
- **File Names**: `LegacyHive.exe`, `offreg.dll` (if packaged locally).
- **Registry Keys**: Modifications to `HKEY_USERS\[SID]\Environment\LocalAppData` pointing to the NT Object Manager namespace.
- **Process Behaviors**:
- Low-privileged users spawning processes under different user contexts.
- Unusual usage of native APIs to create directories in `\BaseNamedObjects\`.
- `Notepad.exe` or other utilities launched with the `CREATE_SUSPENDED` flag during profile load.
## Associated Threat Actors
- **Nightmare-Eclipse** (Developer/Disclosing actor)
## Detection Methods
- **Behavioral Detection**:
- Monitor for the creation of directories within the Windows Object Manager namespace `\BaseNamedObjects\Restricted\` by non-system processes.
- Track cross-user process spawning where the source and target users do not match (excluding standard service accounts).
- **Library Monitoring**: Detect the loading of `Offreg.dll` by unusual or non-standard binaries (excluding Windows Update, Defender, or System installers).
- **SIEM Query Logic**:
- `module.path contains "\\offreg.dll"` AND NOT from legitimate Windows/Defender paths.
- Identifying symbolic link creation at the NT Object Manager level via EDR telemetry.
## Mitigation Strategies
- **Patch Management**: While this was a zero-day/logical abuse PoC, ensure all subsequent Windows security updates are applied.
- **Least Privilege**: Restrict the ability of low-privileged users to log in interactively or store credentials for "helper" accounts that can be abused for such transitions.
- **Endpoint Hardening**: Implement EDR rules to block or alert on unauthorized modification of offline registry hives (`ntuser.dat`) files on disk.
## Related Tools/Techniques
- **GreenPlasma**
- **YellowKey**
- **MiniPlasma**
- **RoguePlanet**
- **GreatXML**
- **Technique**: Redirection of `UsrClass.dat` or `ntuser.dat` via symbolic links.