new: add detection for LegacyHive (ProfSvc) exploit

Author: Bit-ByteBandit

rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml

@@ -8,7 +8,7 @@ references:
     - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
 date: 2017-01-01
-modified: 2024-12-14
+modified: 2026-07-14
 tags:
     - attack.persistence
     - attack.discovery
@@ -85,7 +85,6 @@ detection:
               - '\systeminfo.exe'
               - '\tasklist.exe'
               - '\tracert.exe'
-              - '\ver.exe'
               - '\wevtutil.exe'
               - '\whoami.exe'
         - OriginalFileName:
@@ -101,7 +100,6 @@ detection:
               - 'sysinfo.exe'
               - 'tasklist.exe'
               - 'tracert.exe'
-              - 'ver.exe'
               - 'VSSADMIN.EXE'
               - 'wevtutil.exe'
               - 'whoami.exe'

rules/windows/registry/registry_event/sysmon_win_legacyhive_exploit.yml

@@ -0,0 +1,22 @@
+title: Potential LegacyHive Privilege Escalation (ProfSvc)
+id: 569e2026-6216-418a-b8b8-2a29c9c3e451
+status: experimental
+description: Detects suspicious registry hive loading initiated by the User Profile Service (ProfSvc), indicative of the LegacyHive exploit.
+references:
+    - https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html
+author: ShadowSkillZ (Security Researcher)
+date: 2026-07-16
+logsource:
+    category: registry_event
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\svchost.exe'
+        TargetObject|contains: '\Registry\User\S-1-5-18\'
+    condition: selection
+falsepositives:
+    - Legitimate OS profile loading during user logon. Requires baseline tuning.
+level: high
+tags:
+    - attack.privilege-escalation
+    - attack.t1547