LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC
ID: 5c5f9ab6-4fd8-51be-961b-43c944e33b82
STIX ID: report--5c5f9ab6-4fd8-51be-961b-43c944e33b82
Feed Name: LevelBlue SpiderLabs Blog
Threat Score
Researcher 'Nightmare-Eclipse' publicly released LegacyHive, an unpatched Local Privilege Escalation in Windows User Profile that can load other users' registry hives (including admins) and expose application data and Explorer history; the PoC was intentionally stripped, Microsoft has not released a patch, and the researcher previously released RoguePlanet (SYSTEM race condition) and GreatXML (BitLocker bypass).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.