T1034 Google Chronicle · YARA-L

Detect Path Interception in Google Chronicle

**Deprecated — superseded by T1574.007 (PATH Environment Variable), T1574.008 (Search Order Hijacking), and T1574.009 (Unquoted Path).** Path Interception occurs when an adversary places an executable in a specific filesystem location so that it is resolved and executed instead of the intended system binary. Three distinct variants are covered: **Unquoted Paths:** Service or shortcut paths containing spaces without surrounding quotation marks allow Windows to attempt higher-level path components first during binary resolution. If a service ImagePath is `C:\Program Files\My App\svc.exe` (unquoted), Windows tries `C:\Program.exe` before reaching the intended binary. Adversaries plant malicious executables at these interceptable positions to run with the service's privilege level on next service start or system restart. **PATH Environment Variable Misconfiguration:** If adversary-controlled directories appear in the PATH environment variable before `C:\Windows\system32`, executables placed there with names matching Windows utilities (cmd.exe, net.exe, powershell.exe) will execute preferentially whenever those tools are invoked without a fully qualified path — from scripts, scheduled tasks, or applications. **Search Order Hijacking:** Windows searches the calling application's directory (and the current working directory for cmd.exe invocations) before system directories when resolving unqualified binary names. Placing a malicious binary named after a system tool in an application's working directory causes it to execute instead of the real utility, enabling both persistence and privilege escalation if the calling application runs elevated.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation
Canonical reference
https://attack.mitre.org/techniques/T1034/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1034_path_interception {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1034 Path Interception: binary name hijacking, PATH environment variable manipulation, and unquoted service paths"
    mitre_attack_technique = "T1034"
    mitre_attack_tactics = "TA0003, TA0004"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1034/"

  events:
    (
      /* Signal 1: System binary name executed outside canonical Windows directories */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex(
          $e.target.process.file.full_path,
          `(?i)\\(cmd|net|net1|powershell|ipconfig|whoami|ping|tasklist|sc|reg|msiexec|wscript|cscript|rundll32|regsvr32|certutil|msbuild|wmic|schtasks|systeminfo|netstat|arp|route|at|bitsadmin)\.exe$`
        )
        and not re.regex($e.target.process.file.full_path, `(?i)^C:\\Windows\\.+`)
        and not re.regex($e.target.process.file.full_path, `(?i)^C:\\Program Files\\.+`)
        and not re.regex($e.target.process.file.full_path, `(?i)^C:\\Program Files \(x86\)\\.+`)
        and not re.regex($e.target.process.file.full_path, `(?i)^C:\\ProgramData\\Microsoft\\.+`)
      )
      or
      /* Signal 2: PATH environment variable modified to include user-writable directories */
      (
        $e.metadata.event_type = "REGISTRY_MODIFICATION"
        and (
          re.regex($e.target.registry.registry_key, `(?i)\\Control\\Session Manager\\Environment$`)
          or re.regex($e.target.registry.registry_key, `(?i)(HKCU|HKEY_CURRENT_USER)\\Environment$`)
        )
        and re.regex($e.target.registry.registry_value_name, `(?i)^Path$`)
        and (
          re.regex($e.target.registry.registry_value_data, `(?i)C:\\Users\\`)
          or re.regex($e.target.registry.registry_value_data, `(?i)C:\\Temp\\`)
          or re.regex($e.target.registry.registry_value_data, `(?i)C:\\Windows\\Temp\\`)
          or re.regex($e.target.registry.registry_value_data, `(?i)%USERPROFILE%`)
          or re.regex($e.target.registry.registry_value_data, `(?i)%TEMP%`)
          or re.regex($e.target.registry.registry_value_data, `(?i)%TMP%`)
          or re.regex($e.target.registry.registry_value_data, `(?i)%APPDATA%`)
        )
      )
      or
      /* Signal 3: Service ImagePath set without leading quote and containing space before .exe */
      (
        $e.metadata.event_type = "REGISTRY_MODIFICATION"
        and re.regex($e.target.registry.registry_key, `(?i)\\System\\CurrentControlSet\\Services\\[^\\]+\\ImagePath$`)
        and not re.regex($e.target.registry.registry_value_data, `^["']`)
        and re.regex($e.target.registry.registry_value_data, `(?i)[A-Za-z]:\\.+ .+\.exe`)
      )
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting T1034 Path Interception using UDM PROCESS_LAUNCH and REGISTRY_MODIFICATION event types. Signal 1 matches system utility names executing from outside C:\Windows, C:\Program Files, or C:\ProgramData\Microsoft using regex on target.process.file.full_path. Signal 2 identifies registry modifications to PATH values under HKLM Environment or HKCU Environment that include user-writable or temp directories. Signal 3 catches unquoted service ImagePath values with embedded spaces that allow Windows path resolution to intercept higher-level path components.

Data Sources

Google Chronicle SIEM with Unified Data ModelChronicle Forwarder on Windows endpointsMicrosoft Defender for Endpoint events forwarded to Chronicle via MXDR integrationSysmon logs ingested via Chronicle Windows sensor or Bindplane

Required Tables

UDM Events (PROCESS_LAUNCH)UDM Events (REGISTRY_MODIFICATION)

False Positives & Tuning

  • Windows Subsystem for Linux (WSL2) or Cygwin installations that add user-local binary directories to the Windows PATH during setup, causing expected PATH registry modifications pointing to user profile locations
  • Build automation systems (Jenkins agents, GitHub Actions runners, TeamCity build agents) that stage test executables named after system utilities in workspace directories and temporarily modify PATH during CI pipeline execution
  • Legitimate software vendors shipping applications to Program Files subdirectories with unquoted service paths — a widespread historical Windows packaging defect present in many enterprise software titles
Download portable Sigma rule (.yml)

Other platforms for T1034

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create Vulnerable Unquoted Service Path via Registry

    Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SYSTEM\CurrentControlSet\Services\df00techVulnSvc\ImagePath, Details = 'C:\Program Files\Vulnerable App\service.exe' (note: no leading quote character). Initiating process will be reg.exe or the calling shell. Security Event ID 4657 (registry value modified) if object access auditing is enabled.

  2. Test 2PATH Environment Variable Hijack — Prepend User-Writable Directory

    Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKEY_CURRENT_USER\Environment\Path, Details contains 'C:\Temp\PathHijackTest' as a prefix before standard system directories. Initiating process will be powershell.exe. If Sysmon registry monitoring is not deployed, Security Event ID 4657 may capture this if SACL auditing is configured on HKCU\Environment.

  3. Test 3Search Order Hijacking — Rogue Binary in Application Directory

    Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Temp\SearchOrderTest\net.exe, Image = cmd.exe or the copy command. Sysmon Event ID 1 (Process Create): Image = C:\Temp\SearchOrderTest\net.exe, initiated from cmd.exe with working directory C:\Temp\SearchOrderTest. Note: Windows 10/11 may resolve the fully qualified system net.exe first; result depends on system configuration and whether CurrentDirectory search order applies.

  4. Test 4Unquoted Path Privilege Escalation Simulation — Interceptable Path Position

    Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Program.exe, Image = cmd.exe or the copy command. Security Event ID 4663 (object access) if file system auditing is enabled on C:\. The file creation at C:\ root is unusual and should stand out in file creation baselines — legitimate software rarely creates executable files directly at the root of the system drive.

Last updated: 2026-04-16 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1034 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1574.007Path Interception by PATH Environment VariableT1574.008Path Interception by Search Order HijackingT1574.009Path Interception by Unquoted PathT1574.001DLLT1574.002DLL Side-LoadingT1543.003Windows ServiceT1546.015Component Object Model HijackingT1053.005Scheduled TaskT1078Valid Accounts

Same Tactic: Persistence

Popular Detections