Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday Security researcher Chaotic Eclipse (aka Nightmare-Eclipse) has released a new proof-of-concept (PoC) exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service, also referred to as ProfSvc, is a core system component that manages user accounts and environments. "The PoC requires Res…

https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html

sha256:8307e936cb7aaf24fad3872d5b76bebd1e7bb9cb8cfff5cfc9e1776c7a737bd8

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve5
md50
url0
ipv40
ipv60
sha10
domain1
sha2560
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-45659	Open →
cve	CVE-2026-56155	Open →
cve	CVE-2026-56164	Open →
cve	CVE-2026-32201	Open →
cve	CVE-2026-55040	Open →
domain	usrclass.dat	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Scattered Spider

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports