LegacyHive PoC Execution Followed by SYSTEM Privilege Escalation

Amit Ambekar@Amit007

•updated Sep 2, 2026•0•0•5

Detects the 'LegacyHive.exe' process initiating child processes running under the SYSTEM account context. This behavior is indicative of potential privilege escalation or malicious persistence mechanisms where a process spawns a child with elevated permissions.