NightmareEclipse 2026: LegacyHive Windows 0-Day Exposed — Full Attack Chain, MDE Detection Queries & Blue Team Playbook

On July 14, 2026 – a date the actor publicly pre-announced as a “bone shattering” drop – a researcher operating under the alias Nightmare Eclipse released LegacyHive: a working proof-of-concept exploit targeting a design-level flaw in the Windows User Profile Service (ProfSvc). As of July 16, 2026, this vulnerability carries no CVE, no Microsoft advisory, and no patch. It affects every supported Windows desktop and server edition, including fully patched July 2026 Patch Tuesday systems.

LegacyHive is the eighth exploit in Nightmare Eclipse’s escalating retaliatory campaign against Microsoft – a campaign that began in April 2026 and has already produced three vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, actively weaponized from Russian-geolocated infrastructure within days of release. This post delivers the complete technical breakdown: both the unpatched LegacyHive primitive and the separately patched RoguePlanet (CVE-2026-50656) SYSTEM-level escalation, full attack chains, MITRE ATT&CK mapping, validated MDE Advanced Hunting and Sentinel KQL queries, and a blue team detection playbook.

Critical Note for Blue Teams: “LegacyHive” is the name Nightmare Eclipse chose for this exploit tool. It has no relationship to the Hive ransomware group or its successor Hunters International. The naming overlap is coincidental and has caused confusion in early reporting.

The Nightmare Eclipse Campaign: Full Context

Who Is Nightmare Eclipse?

Nightmare Eclipse is an individual operating under the aliases MSNightmare (banned GitHub account), Chaotic Eclipse (blog persona at deadeclipse666[.]blogspot[.]com), and Dead Eclipse. Open-source reporting suggests a possible former Microsoft employee or contractor with an employment window between September 2022 and June 2025, possessing insider-level Windows internals knowledge. Possible Germany-based origin has been noted but not confirmed.

The actor’s stated motivation is a personal grievance: “Microsoft violated an unspecified agreement and left me homeless with nothing.” The blog claims direct threats from Microsoft Security Response Center (MSRC) personnel. This is a targeted retaliatory campaign by a technically sophisticated individual – not a financially or geopolitically motivated threat actor.

The actor has a declared dead man’s switch with automated release triggers for future exploits. Treat this as an ongoing campaign with no defined end.

The Complete Exploit Catalog

Campaign Timeline

LegacyHive: Vulnerability Anatomy

What Is the Bug?

The Windows User Profile Service (ProfSvc) performs insufficient validation when loading registry hives during profile initialization. A standard, non-privileged user can chain three sub-techniques – offline registry hive modification, Object Manager symbolic link redirection, and synchronized process creation with batch oplock timing – to force ProfSvc to load a different user’s UsrClass.dat hive into the attacker-controlled user’s HKU<SID>_Classes namespace.

This is a design-level flaw, not a memory-safety vulnerability. No buffer overflow, no kernel exploit, no administrator rights required. The attack requires two local standard user accounts: a helper account (controlled by the attacker) and a target account (an administrator or any user whose hive is of value).

Root Cause: The Profile Service Trust Chain

When ProfSvc loads a user’s profile, it reads the Local AppData value from:

HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell FoldersLocal AppData

ProfSvc trusts this value to locate and load UsrClass.dat (the user’s COM class registration hive). The flaw: ProfSvc does not adequately validate that the resolved path actually belongs to the authenticating user. An attacker who can modify the helper account’s NTUSER.DAT offline (bypassing live filesystem locks) can redirect this value to an attacker-controlled Object Manager namespace path, causing ProfSvc to load any arbitrary UsrClass.dat – including the target administrator’s.

Practical Impact

The published PoC grants a non-admin user read-write access to an administrator’s class registration hive. Security researcher Will Dormann described this as “a genuinely useful primitive” for attack chaining. With write access to the target’s classes root, an attacker can:

• Modify COM class registrations to redirect code execution
• Inject malicious shell extension handlers into the target’s context
• Tamper with file associations to trigger payload execution under target SID
• Access credential-bearing registry entries in the target’s hive

The original (non-stripped) version of the exploit reportedly supports loading any hive including those containing credential material. The public PoC was intentionally limited to avoid maximum abuse potential.

LegacyHive: Full Exploitation Chain

Execution syntax: LegacyHive.exe <HelperAccount> <HelperPassword> <TargetUser>

Phase 1: Staging Environment Construction

# What the exploit does internally:
# 1. Generates a random GUID as working directory name
# 2. Creates C:{GUID} with permissive DACL (GENERIC_ALL for Everyone)
# 3. Stages decoy ntuser.dat and UsrClass.dat files in this directory

The GUID-named directory receives a permissive DACL granting GENERIC_ALL to Everyone, ensuring the exploit can operate without UAC prompts or admin elevation.

Phase 2: Object Manager Namespace Construction

The exploit resolves NtCreateSymbolicLinkObject and NtCreateDirectoryObjectEx from ntdll.dll and builds a deceptive Object Manager namespace:

# Object Manager paths created:
\.GlobalRootBaseNamedObjectsRestricted{GUID}
\.GlobalRootBaseNamedObjectsRestrictedMicrosoft
\.GlobalRootBaseNamedObjectsRestrictedMicrosoftWindows  → C:{GUID}
# ↑ Symbolic link: "Windows" resolves to attacker-controlled staging dir

Net effect: any path that resolves through \.GlobalRootBaseNamedObjectsRestrictedMicrosoftWindows will continue resolution within C:{GUID} – the attacker’s staging directory. This is the redirection primitive.

Phase 3: Offline NTUSER.DAT Modification

The exploit authenticates as the helper account via LogonUserW + ImpersonateLoggedOnUser, then uses the Offline Registry Library to modify the helper’s NTUSER.DAT without loading it live (bypassing live-file locks):

# Offline Registry Library API chain:
OROpenHiveByHandle(helper_ntuser_dat)
OROpenKey("SoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders")
ORSetValue("Local AppData", "\.GlobalRootBaseNamedObjectsRestricted")
ORSaveHive(helper_ntuser_dat)
# ↑ Poisons helper account's Local AppData to the attacker Object Manager namespace

This is the key misdirection: ProfSvc will now resolve the helper’s UsrClass.dat path through the attacker-controlled Object Manager symbolic link.

Phase 4: Batch Oplock + Synchronized Profile Load (Race Trigger)

# Step 1: Stage target user's UsrClass.dat copy
copy C:Users{target}AppDataLocalMicrosoftWindowsUsrClass.dat C:{GUID}MicrosoftWindowsUsrClass.dat

# Step 2: Place batch oplock on the staged copy
# FSCTL_REQUEST_BATCH_OPLOCK on C:{GUID}MicrosoftWindowsUsrClass.dat

# Step 3: Trigger ProfSvc profile load via CreateProcessWithLogonW
CreateProcessWithLogonW(
    user=HelperAccount,
    flags=LOGON_WITH_PROFILE | CREATE_SUSPENDED,
    binary=notepad.exe   # benign carrier
)
# LOGON_WITH_PROFILE  → forces ProfSvc to fully load helper's profile
# CREATE_SUSPENDED    → holds process alive without executing, maintaining oplock context

Phase 5: Oplock Fires – Hive Substitution

# Sequence during ProfSvc profile initialization:
# 1. ProfSvc reads poisoned Local AppData value → \.GlobalRootBaseNamedObjectsRestricted
# 2. Object Manager resolves → C:{GUID}MicrosoftWindowsUsrClass.dat (staged copy)
# 3. Oplock fires when ProfSvc touches the staged file
# 4. Exploit closes the symbolic link → path now resolves to LIVE target UsrClass.dat
# 5. ProfSvc loads target administrator's UsrClass.dat into HKU{HelperSID}_Classes

The race window is precisely controlled by the oplock. The oplock fires exactly when ProfSvc opens the file, giving the exploit deterministic timing to swap the symbolic link target before ProfSvc completes the load.

Phase 6: Exploitation

# Validation: open helper's classes root - should contain target's data
RegOpenUserClassesRoot(helper_token) → confirms target hive loaded

# With write access to target's HKU{TargetSID}_Classes:
# Option A: COM hijack
reg add "HKU{HelperSID}_ClassesCLSID{target-CLSID}InprocServer32" /ve /d "C:payload.dll"

# Option B: Shell extension injection (triggers on next Explorer interaction by target)
# Option C: File association hijack - .txt → malicious binary
# Option D: Pivot to credential-bearing portions of hive

Win32/NT API Fingerprint (LegacyHive)

RoguePlanet (CVE-2026-50656): The SYSTEM-Level Escalation

Vulnerability Overview

RoguePlanet exploits a TOCTOU race condition in the Microsoft Defender Malware Protection Engine’s file-handling and quarantine pipeline. The gap between Defender’s artifact creation and path validation is exploitable through a coordinated chain of NTFS reparse points, opportunistic locks on alternate data streams, VSS snapshots, and Windows Error Reporting scheduled task abuse. No memory corruption, no kernel bugs, no admin rights required. Full SYSTEM execution on Windows 10 and 11 (all editions, fully patched through June 2026).

Patch: Defender engine version 1.1.26060.3008 (auto-updated July 9, 2026). Verify with: Get-MpComputerStatus | Select-Object AMEngineVersion

Full Exploitation Chain (RoguePlanet)

Stage 1: Entry Point Check

# Binary checks current integrity level
# If already SYSTEM → delivers shell via \.pipeRoguePlanet (named pipe)
# Otherwise → proceeds with escalation

Stage 2: I/O Saturation (Race Condition Setup)

# Spawns generator thread + per-core worker threads
# Writes UUID-named temp files to create scheduling pressure
# Creates deterministic kernel scheduling conditions favorable to the race

Stage 3: Defender Invocation via MpClient.dll

# Loads MpClient.dll directly (not via MsMpEng.exe)
# Calls Defender scanning RPC APIs:
MpManagerOpen → MpScanStart → MpScanResult → MpThreatOpen →
MpThreatEnumerate → MpCleanOpen → MpCleanStart

# Creates EICAR-containing lure at:
%TEMP%RP_{GUID}System32wermgr.exe   # EICAR data inside → triggers Defender

Stage 4: ISO Extraction + VSS Monitoring

# Extracts embedded ISO → mounts as virtual disk
OpenVirtualDisk + AttachVirtualDisk
# ISO contains EICAR-named wermgr.exe to feed Defender's scan

# Simultaneously monitors for VSS snapshot creation:
NtQueryDirectoryObject on DeviceHarddiskVolumeShadowCopy*

Stage 5: Oplock + NTFS Junction Manipulation

# Places batch oplock on Alternate Data Stream (ADS):
# %TEMP%RP_{GUID}System32:WDFOO

# Converts directory to NTFS reparse point → targets ISO mount
# Oplock fires when Defender touches the ADS

# On oplock fire:
# Redirect junction → attacker's temp directory (swap!)

Stage 6: SYSTEM File Handle Capture + Payload Injection

# Defender creates quarantine file owned by SYSTEM
# While Defender holds SYSTEM-owned file handle open:
# Overwrite file content with exploit binary
NtSetInformationFile(FileRenameInformationEx) → reposition SYSTEM-owned file

Stage 7: Task Scheduler SYSTEM Execution

# Final NTFS junction redirect:
# %TEMP%RP_{GUID}System32wermgr.exe ← appears as C:WindowsSystem32wermgr.exe

# Trigger QueueReporting scheduled task via COM (runs as NT AUTHORITYSYSTEM):
CoCreateInstance(CLSID_TaskScheduler)
→ Trigger MicrosoftWindowsWindows Error ReportingQueueReporting

# wermgr.exe executes as S-1-5-18 (SYSTEM)
# Delivers SYSTEM shell via \.pipeRoguePlanet

Key APIs (RoguePlanet)

MITRE ATT&CK Mapping

LegacyHive

RoguePlanet (CVE-2026-50656)

Technical Indicators of Compromise

LegacyHive File Artifacts

LegacyHive Registry Artifacts

Suspicious Object Manager Paths

• \.GlobalRootBaseNamedObjectsRestricted{GUID}
• \.GlobalRootBaseNamedObjectsRestrictedMicrosoft
• \.GlobalRootBaseNamedObjectsRestrictedMicrosoftWindows (symbolic link → attacker dir)

RoguePlanet File Artifacts

Threat Actor Infrastructure (IOCs)

• deadeclipse666[.]blogspot[.]com – actor blog (advance exploit announcements)
• git.projectnightcrawler[.]dev/NightmareEclipse/LegacyHive – PoC repository
• Russian-geolocated IPs – in-the-wild BlueHammer/RedSun/UnDefend exploitation

Microsoft Sentinel KQL Detection Queries

Sentinel Query 1: LegacyHive – User Shell Folders Registry Tampering

// Detect LegacyHive's core registry poisoning technique
// Local AppData redirected to Object Manager namespace path
SecurityEvent
| where EventID == 4657
| where ObjectName contains "User Shell Folders"
| where OperationType == "%%1905"  // Existing registry value modified
| extend RegValue = tostring(parse_json(EventData).ObjectValueName)
| extend NewData  = tostring(parse_json(EventData).NewValue)
| where RegValue =~ "Local AppData"
| where NewData contains "GlobalRoot"
    or NewData contains "BaseNamedObjects"
    or NewData contains "\.\"
    or NewData !startswith "C:\Users\"
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
          ObjectName, RegValue, NewData, ProcessName
| sort by TimeGenerated desc

Sentinel Query 2: LegacyHive – Cross-SID Profile Load with Suspended Process

// Detect CreateProcessWithLogonW with LOGON_WITH_PROFILE on alternate account
// High-fidelity LegacyHive execution indicator
SecurityEvent
| where EventID == 4648  // Explicit credentials used
| where LogonProcessName == "seclogo"
| where SubjectUserName != TargetUserName
| where TargetDomainName == "."  // Local account
| project TimeGenerated, Computer, SubjectUserName, TargetUserName,
          ProcessName, IpAddress, LogonType
| join kind=inner (
    SecurityEvent
    | where EventID == 4688
    | where NewProcessName has_any ("notepad.exe","calc.exe","mspaint.exe","msiexec.exe")
    | project Computer, ProcessTime = TimeGenerated,
              NewProcessName, ParentProcessName, SubjectLogonId
) on Computer
| where abs(datetime_diff('second', TimeGenerated, ProcessTime)) < 10
| project TimeGenerated, Computer, SubjectUserName, TargetUserName,
          NewProcessName, ParentProcessName, ProcessName
| sort by TimeGenerated desc

Sentinel Query 3: LegacyHive – NTUSER.DAT Access by Non-Profile Service

// Alert on offline registry hive modification outside normal profile provisioning
// Catches OROpenHiveByHandle/ORSaveHive pattern used by LegacyHive
SecurityEvent
| where EventID == 4663
| where ObjectType == "File"
| where ObjectName has_any ("ntuser.dat", "UsrClass.dat", "NTUSER.DAT")
| where ObjectName !startswith "C:\Windows\"
| where SubjectUserName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| where ProcessName !in~ (
    "userinit.exe", "winlogon.exe", "regedit.exe",
    "reg.exe", "lsass.exe", "svchost.exe"
)
| where AccessMask has_any ("0x2", "0x4", "0x40", "0x100002")  // Write access masks
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
          ObjectName, ProcessName, AccessMask
| sort by TimeGenerated desc

Sentinel Query 4: RoguePlanet – MsMpEng Spawning Shell Processes

// Highest-fidelity RoguePlanet indicator
// Defender engine spawning interactive shell as SYSTEM
SecurityEvent
| where EventID == 4688
| where ParentProcessName has "MsMpEng.exe"
| where NewProcessName has_any (
    "cmd.exe", "powershell.exe", "pwsh.exe",
    "conhost.exe", "cscript.exe", "wscript.exe", "mshta.exe"
)
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId,
          NewProcessName, CommandLine, ParentProcessName
| sort by TimeGenerated desc

Sentinel Query 5: RoguePlanet – wermgr.exe Executing as SYSTEM Outside Schedule

// QueueReporting task abuse: wermgr.exe running as SYSTEM from unexpected parent
SecurityEvent
| where EventID == 4688
| where NewProcessName has "wermgr.exe"
| where SubjectUserSid == "S-1-5-18"  // NT AUTHORITYSYSTEM
| where ParentProcessName !in~ ("svchost.exe", "taskhost.exe", "taskhostw.exe")
| project TimeGenerated, Computer, SubjectUserName,
          NewProcessName, CommandLine, ParentProcessName
// Correlate with task scheduler event within 60s window
| join kind=leftouter (
    Event
    | where Source == "Microsoft-Windows-TaskScheduler"
    | where EventID in (200, 201)
    | where RenderedDescription contains "QueueReporting"
    | project TaskTime = TimeGenerated, Computer
) on Computer
| where abs(datetime_diff('second', TimeGenerated, TaskTime)) < 60
| sort by TimeGenerated desc

MDE Advanced Hunting Queries

MDE Query 1: LegacyHive – Registry Hive File Access by Non-System Processes

// Detect offline hive manipulation - core LegacyHive primitive
// OROpenHiveByHandle/ORSaveHive from user-space process
DeviceFileEvents
| where FileName in~ ("ntuser.dat", "UsrClass.dat")
| where ActionType in ("FileModified", "FileCreated", "FileCopied", "FileRenamed")
| where FolderPath !startswith "C:\Windows\"
| where InitiatingProcessAccountName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| where InitiatingProcessFileName !in~ (
    "userinit.exe", "winlogon.exe", "lsass.exe",
    "reg.exe", "regedit.exe", "svchost.exe"
)
| project Timestamp, DeviceName, DeviceId,
          FileName, FolderPath, ActionType,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, InitiatingProcessAccountDomain
| sort by Timestamp desc

MDE Query 2: LegacyHive – User Shell Folders Redirection via Registry

// Catch Local AppData poisoning - the registry modification that enables hive swap
DeviceRegistryEvents
| where RegistryKey contains "User Shell Folders"
| where RegistryValueName =~ "Local AppData"
| where RegistryValueData contains "GlobalRoot"
    or RegistryValueData contains "BaseNamedObjects"
    or RegistryValueData contains "\.\"
    or (RegistryValueData !startswith "C:\Users\"
        and RegistryValueData !startswith "%USERPROFILE%")
| project Timestamp, DeviceName, DeviceId,
          RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName
| sort by Timestamp desc

MDE Query 3: LegacyHive – Cross-Account Suspended Process with Profile Load

// Detect CreateProcessWithLogonW + LOGON_WITH_PROFILE + CREATE_SUSPENDED pattern
// Hallmark LegacyHive behavior for ProfSvc profile-load trigger
DeviceProcessEvents
| where ProcessCreationFlags has_any ("0x4", "CREATE_SUSPENDED")
| where AccountName != InitiatingProcessAccountName
| where InitiatingProcessFileName !in~ (
    "lsass.exe", "winlogon.exe", "userinit.exe",
    "services.exe", "wininit.exe", "csrss.exe"
)
| where FileName in~ (
    "notepad.exe", "calc.exe", "mspaint.exe", "msiexec.exe",
    "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe"
)
| project Timestamp, DeviceName, DeviceId,
          FileName, ProcessCommandLine, AccountName, AccountSid,
          InitiatingProcessFileName, InitiatingProcessAccountName,
          InitiatingProcessCommandLine, ProcessCreationFlags
| sort by Timestamp desc

MDE Query 4: RoguePlanet – MsMpEng Spawning SYSTEM Shell

// Highest-confidence RoguePlanet detection - SYSTEM shell from Defender engine
DeviceProcessEvents
| where InitiatingProcessFileName =~ "MsMpEng.exe"
| where FileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe",
    "conhost.exe", "cscript.exe", "wscript.exe", "mshta.exe"
)
| where AccountSid == "S-1-5-18"  // NT AUTHORITYSYSTEM
| project Timestamp, DeviceName, DeviceId,
          FileName, ProcessCommandLine, AccountSid, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

MDE Query 5: RoguePlanet – Named Pipe RoguePlanet Shell Delivery

// Named pipe creation/connection as SYSTEM shell delivery mechanism
DeviceEvents
| where ActionType in ("NamedPipeEvent", "NamedPipeServerCreated", "NamedPipeClientConnected")
| where AdditionalFields contains "RoguePlanet"
| project Timestamp, DeviceName, DeviceId, ActionType,
          InitiatingProcessFileName, InitiatingProcessAccountName,
          InitiatingProcessCommandLine, AdditionalFields
| sort by Timestamp desc

MDE Query 6: RoguePlanet – Defender Engine Loading MpClient.dll Outside Normal Context

// MpClient.dll loaded by non-Defender process - RoguePlanet's Defender invocation
DeviceImageLoadEvents
| where FileName =~ "MpClient.dll"
| where InitiatingProcessFileName !in~ (
    "MsMpEng.exe", "MpCmdRun.exe", "MpDlpCmd.exe",
    "SecurityHealthService.exe", "msmpeng.exe"
)
| project Timestamp, DeviceName, DeviceId,
          FileName, FolderPath,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName
| sort by Timestamp desc

MDE Query 7: VSS Enumeration from User-Space (Both Exploits)

// Volume Shadow Copy enumeration from user-space process
// Used by RoguePlanet; also diagnostic of HiveNightmare CVE-2021-36934
DeviceEvents
| where ActionType == "ProcessAccessed"
| where AdditionalFields contains "HarddiskVolumeShadowCopy"
| where InitiatingProcessIntegrityLevel !in ("System", "High")
| where InitiatingProcessFileName !in~ (
    "vssvc.exe", "vdsldr.exe", "diskshadow.exe",
    "wbengine.exe", "svchost.exe"
)
| project Timestamp, DeviceName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, InitiatingProcessIntegrityLevel,
          AdditionalFields
| sort by Timestamp desc

MDE Query 8: Pre-Ransomware / Post-Exploit Correlation – Full Kill Chain

// Correlate LegacyHive + lateral movement indicators within a 2-hour window
// Detects the full attack chain: hive swap → privilege escalation → lateral movement
let HiveSwapEvents = DeviceFileEvents
    | where FileName in~ ("ntuser.dat", "UsrClass.dat")
    | where ActionType in ("FileModified", "FileCopied")
    | where InitiatingProcessFileName !in~ ("userinit.exe","winlogon.exe","lsass.exe")
    | project HiveTime = Timestamp, DeviceName, HiveFile = FileName,
              HiveProcess = InitiatingProcessFileName,
              HiveAccount = InitiatingProcessAccountName;
let LateralMovement = DeviceNetworkEvents
    | where RemotePort in (445, 135, 3389)
    | where ActionType == "ConnectionSuccess"
    | where InitiatingProcessFileName !in~ ("svchost.exe","lsass.exe")
    | project NetTime = Timestamp, DeviceName, RemoteIP, RemotePort,
              NetProcess = InitiatingProcessFileName,
              NetAccount = InitiatingProcessAccountName;
HiveSwapEvents
| join kind=inner LateralMovement on DeviceName
| where NetTime > HiveTime
| where datetime_diff('minute', NetTime, HiveTime) <= 120
| project HiveTime, DeviceName, HiveFile, HiveProcess, HiveAccount,
          NetTime, RemoteIP, RemotePort, NetProcess, NetAccount,
          MinutesBetween = datetime_diff('minute', NetTime, HiveTime)
| sort by HiveTime desc

Blue Team Detection Playbook

Endpoint Detection – Behavioral Indicators

LegacyHive (High Confidence):

• Standard user process opening NTUSER.DAT of a different user via Offline Registry Library pattern (non-userinit.exe, non-winlogon.exe process)
• UsrClass.dat copied outside its expected AppDataLocalMicrosoftWindows path
• Object Manager symbolic link created under BaseNamedObjectsRestricted by user-space process
• Hive replacement and restoration within a 2-10 second window (rapid oplock-timed swap)
• FSCTL_REQUEST_BATCH_OPLOCK issued on a user-profile hive file from non-system process
• Benign binary (notepad.exe, calc.exe) launched under alternate account SID via CreateProcessWithLogonW with LOGON_WITH_PROFILE

RoguePlanet (High Confidence):

• MpClient.dll loaded outside MsMpEng.exe or MpCmdRun.exe context
• Virtdisk.dll loaded in user-space process (ISO mounting from non-admin context)
• NTFS junction/reparse-point creation in %TEMP% path immediately followed by Defender scanning activity
• conhost.exe spawned from a SYSTEM-integrity parent with no cmd.exe terminal ancestor
• wermgr.exe hash deviation from Microsoft-signed baseline
• Named pipe \.pipeRoguePlanet creation from user-space process

Event ID Quick Reference

Remediation and Hardening

LegacyHive – No Patch, Mitigations Only

1. Restrict Local Account Creation – LegacyHive requires a second local user account (helper). Limit local account creation via GPO: Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Add workstation to domain.

2. Enable SACL Auditing on Hive Files – Apply advanced audit policy for object access on NTUSER.DAT and UsrClass.dat. Alert on any process writing these files that is not userinit.exe or winlogon.exe:

   auditpol /set /subcategory:"File System" /success:enable /failure:enable

3. Registry Value Monitoring – Enable Audit Registry for HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders. Alert immediately on Local AppData changes to Object Manager paths:

   auditpol /set /subcategory:"Registry" /success:enable /failure:enable

4. Application Allowlisting (Highest ROI) – Deploy WDAC, AppLocker, or ThreatLocker in deny-by-default mode. Block execution of unsigned/untrusted binaries from %TEMP% and user-writable paths. This stops the PoC binary regardless of the underlying technique. ThreatLocker policy: TL.EV.1827 - Detection of Malware (Defender: LegacyHive).

5. Multi-Session Environment Priority – LegacyHive is most dangerous on Remote Desktop Session Hosts and VDI where multiple user accounts coexist. Apply tightest controls on these first.

6. Monitor Nightmare Eclipse Infrastructure – Add deadeclipse666[.]blogspot[.]com and git.projectnightcrawler[.]dev to DNS/proxy blocklists and set up RSS/web change alerts for advance warning of future exploit drops.

RoguePlanet – Verify Patch First

# Verify Defender engine version (must be ≥ 1.1.26060.3008)
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion

# If behind, force update:
Update-MpSignature -UpdateSource MicrosoftUpdateServer

If patching is delayed, block ISO/VHD mounting for standard users via GPO: Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption. Also restrict symlink evaluation:

fsutil behavior set SymlinkEvaluation R2L:0 R2R:0

Full Nightmare Eclipse Campaign Patch Checklist

Key Intelligence Summary

1. LegacyHive is unpatched as of July 16, 2026. No CVE, no Microsoft advisory, no fix. Application allowlisting is the only reliable technical control today.
2. RoguePlanet (CVE-2026-50656) is patched. If your Defender engine auto-updates are not blocked, you are protected. If they are blocked, you are at critical risk of SYSTEM-level compromise.
3. LegacyHive has no relationship to Hive ransomware. The name was chosen by Nightmare Eclipse. Conflating the two creates false threat models.
4. Three exploits are actively being weaponized in the wild (BlueHammer, RedSun, UnDefend) from Russian-geolocated infrastructure – CISA KEV listed. The actor’s tooling is being operationalized by external threat actors faster than Microsoft can patch.
5. The actor has a dead man’s switch and additional exploits staged. Monitor deadeclipse666[.]blogspot[.]com for advance announcements.
6. Highest single detection ROI: MsMpEng.exe spawning any shell with SYSTEM integrity (RoguePlanet). CreateProcessWithLogonW + LOGON_WITH_PROFILE + CREATE_SUSPENDED under cross-SID context with concurrent NTUSER.DAT modification (LegacyHive). Deploy both MDE Query 4 and MDE Query 3 from this post immediately.