Another zero-day vulnerability has been revealed by a researcher hours after Microsoft released its July edition of Patch Tuesday. A security researcher named Nightmare Eclipse has discovered the flaw and released a proof-of-concept exploit named Legacy Hive.

Through this blog, we will understand what zero-day is about, the threat it poses, and what organizations can do to prevent the risks and threats posed by it.

About the vulnerability  

What can attackers do?

ProfSvc (Windows User Profile Service) is a Microsoft Windows system component that is responsible for managing user accounts and environments.

It is not an initial access vulnerability but a post-compromise vulnerability. So, any hacker with initial access can exploit this vulnerability to gain elevated privileges to further their attack. It lets attackers gain SYSTEM-level privileges.

Attackers can exploit the vulnerability to:

• Disable security mechanisms (like turning off Microsoft Defender, EDR agents, and antivirus).
• Hide malicious activity through actions like clearing Windows event logs, terminating security processes, or manipulating logging to evade detection.
• Deploy advanced ransomware that embeds deeply into the operating system or spreads malware across the network.
• Steal credentials, password hashes, Kerberos tickets, cached credentials, passwords, and other secrets.
• Create persistent backdoors like adding hidden administrator accounts, install malicious services, schedule tasks, or add kernel level components that survive reboots.
• Execute malicious codes with SYSTEM level privileges, bypassing user level restrictions.
• Steal sensitive data by accessing files and folders that normal user account couldn’t read like confidential business documents and application data.
• Further orchestrate advanced attacks by establishing foothold through a compromised machine.

SharkStriker’s recommendations

• Apply the Microsoft security update immediately.
• Restrict local administrator privileges.

SharkStriker’s action

• Implemented a behavior-based detection rule to identify potential exploitation attempts.
• Continuously tracking Microsoft’s advisory for the official patch.
• Restrict execution of untrusted applications and scripts using application control technologies such as AppLocker or Windows Defender Application Control (WDAC).
• Ensure Microsoft Defender and endpoint protection solutions remain fully updated.