A researcher dropped a working proof-of-concept called LegacyHive hours after July Patch Tuesday. It abuses the Windows User Profile Service to reach admin on fully patched machines – and it only needs a standard user account. Here is what it does and how to contain it while there is no fix.
