The 'Legacy Hive' zero-day vulnerability disclosed by Chaotic Eclipse exploits the Windows User Profile Service (ProfSvc) to perform arbitrary hive loads, enabling Elevation of Privilege on fully patched Windows systems. The exploit works by mounting user registry hives such as usrclass.dat or ntuser.dat into the current user's classes root, bypassing existing patch protections. Detection methods include KQL queries focusing on command-line utility abuse (e.g., reg.exe loading suspicious hives) and unusual registry mounting activities. No official patch or vendor advisory has been referenced in the provided data.

This vulnerability allows attackers to escalate privileges on fully patched Windows systems by manipulating user registry hives, potentially leading to unauthorized access or control escalation. Since it affects fully patched systems, it represents a significant risk until mitigated or patched.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, defenders can deploy the shared KQL hunting queries to detect suspicious registry hive load activities and anomalous registry mounting events indicative of exploitation attempts. No official fix or vendor mitigation has been stated in the provided information.