Detects the creation of Windows registry hive files UsrClass.dat or NTUSER.DAT outside of standard user profile locations. The rule fires when a file named UsrClass.dat or NTUSER.DAT is created, but only if the path is not one of the common, legitimate hive locations (e.g., the main UsrClass.dat path under AppData/Local/Microsoft/Windows or the standard NTUSER.DAT location under a user profile) and not located in typical system directories (C:\Windows\System32\config\, C:\Windows\SYSVOL\, C:\Windows\ServiceProfiles\). This behavior can indicate an attacker staging user registry hives for persistence, privilege escalation, or credential harvesting by manipulating user registry settings. The rule is high severity and includes exclusions to reduce noise from legitimate or forensic tools. False positives include backup/profile-migration software and forensic acquisition tools. References point to LegacyHive implementations.