Windows User Hive File Created Outside a User Profile Path

title: Windows User Hive File Created Outside a User Profile Path
id: 8fb9b2ee-cfa3-4c83-a4bc-b403c5a0cff7
status: stable
author: FRAME ZERO
date: 2026-07-16
description: Detects creation of ntuser.dat or UsrClass.dat outside a path containing the Windows Users directory. This behavior covers staging used by LegacyHive and similar copying of user registry hives into temporary or shared system locations.
references:
  - https://www.threatlocker.com/blog/legacyhive-video-demo-and-analysis-of-windows-0-day-from-nightmareeclipse
  - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive
logsource:
  category: file_event
  product: windows
detection:
  selection_hive:
    TargetFilename|endswith:
      - '\ntuser.dat'
      - '\UsrClass.dat'
  filter_profile_path:
    TargetFilename|contains: '\Users\'
  condition: selection_hive and not filter_profile_path
falsepositives:
  - Approved profile backup, migration, repair, or forensic acquisition tools that copy user registry hives outside their normal profile paths
  - Endpoint security or support tooling that temporarily stages hive files for offline inspection
level: high
tags:
  - attack.collection
  - attack.t1005
related_publication: legacyhive-windows-profile-hive-path-switching
telemetry_assumptions:
  - File telemetry records creation or copying of registry hive files with the complete destination path and initiating process.
  - Analysts can identify the creating user, process signer, destination permissions, and nearby profile activity.