Detect Path Interception in Elastic Security
**Deprecated — superseded by T1574.007 (PATH Environment Variable), T1574.008 (Search Order Hijacking), and T1574.009 (Unquoted Path).** Path Interception occurs when an adversary places an executable in a specific filesystem location so that it is resolved and executed instead of the intended system binary. Three distinct variants are covered: **Unquoted Paths:** Service or shortcut paths containing spaces without surrounding quotation marks allow Windows to attempt higher-level path components first during binary resolution. If a service ImagePath is `C:\Program Files\My App\svc.exe` (unquoted), Windows tries `C:\Program.exe` before reaching the intended binary. Adversaries plant malicious executables at these interceptable positions to run with the service's privilege level on next service start or system restart. **PATH Environment Variable Misconfiguration:** If adversary-controlled directories appear in the PATH environment variable before `C:\Windows\system32`, executables placed there with names matching Windows utilities (cmd.exe, net.exe, powershell.exe) will execute preferentially whenever those tools are invoked without a fully qualified path — from scripts, scheduled tasks, or applications. **Search Order Hijacking:** Windows searches the calling application's directory (and the current working directory for cmd.exe invocations) before system directories when resolving unqualified binary names. Placing a malicious binary named after a system tool in an application's working directory causes it to execute instead of the real utility, enabling both persistence and privilege escalation if the calling application runs elevated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1034/
Elastic Detection Query
any where
(
/* Signal 1: System binary name executed outside canonical Windows paths */
(
event.category == "process" and event.type == "start"
and process.name in~ (
"cmd.exe", "net.exe", "net1.exe", "powershell.exe", "ipconfig.exe",
"whoami.exe", "ping.exe", "tasklist.exe", "sc.exe", "reg.exe",
"msiexec.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe",
"certutil.exe", "msbuild.exe", "wmic.exe", "schtasks.exe", "systeminfo.exe",
"netstat.exe", "arp.exe", "route.exe", "at.exe", "bitsadmin.exe"
)
and not (
process.executable like~ "C:\\Windows\\*"
or process.executable like~ "C:\\Program Files\\*"
or process.executable like~ "C:\\Program Files (x86)\\*"
or process.executable like~ "C:\\ProgramData\\Microsoft\\Windows Defender\\*"
)
)
or
/* Signal 2: PATH environment variable registry modification to include user-writable paths */
(
event.category == "registry"
and event.type in ("change", "creation")
and (
registry.path like~ "*\\Control\\Session Manager\\Environment\\Path"
or registry.path like~ "*\\HKEY_CURRENT_USER\\Environment\\Path"
or registry.path like~ "*\\HKCU\\Environment\\Path"
)
and (
registry.data.strings like~ "*C:\\Users\\*"
or registry.data.strings like~ "*C:\\Temp\\*"
or registry.data.strings like~ "*C:\\Windows\\Temp\\*"
or registry.data.strings like~ "*%USERPROFILE%*"
or registry.data.strings like~ "*%TEMP%*"
or registry.data.strings like~ "*%TMP%*"
or registry.data.strings like~ "*%APPDATA%*"
)
)
or
/* Signal 3: Service ImagePath written without quotes and containing spaces */
(
event.category == "registry"
and event.type in ("change", "creation")
and registry.path like~ "*\\Services\\*\\ImagePath"
and not registry.data.strings like~ "\"*"
and registry.data.strings like~ "* *.exe*"
)
)Detects T1034 Path Interception via three signals using ECS-normalized endpoint and registry events: (1) system utility names (cmd.exe, powershell.exe, etc.) launched from outside canonical Windows directories indicating search order hijacking; (2) PATH environment variable registry keys modified to prepend user-writable or temp directories enabling utility substitution; (3) service ImagePath registry values written unquoted with embedded spaces, creating interception opportunities at higher path components on service restart.
Data Sources
Required Tables
False Positives & Tuning
- Portable application suites (PortableApps.com platform, NirSoft utilities) that bundle renamed copies of system executables within their own install directories for self-contained operation
- Developer toolchains (Python pip scripts, Node.js global packages, Go binaries) that legitimately extend PATH via %APPDATA%\Python\Scripts or %USERPROFILE%\go\bin during user-local tool installation
- Third-party software installers that write service registry entries with unquoted paths containing spaces before correcting them in a later installation phase, triggering a transient false positive
Other platforms for T1034
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Unquoted Service Path via Registry
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SYSTEM\CurrentControlSet\Services\df00techVulnSvc\ImagePath, Details = 'C:\Program Files\Vulnerable App\service.exe' (note: no leading quote character). Initiating process will be reg.exe or the calling shell. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2PATH Environment Variable Hijack — Prepend User-Writable Directory
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKEY_CURRENT_USER\Environment\Path, Details contains 'C:\Temp\PathHijackTest' as a prefix before standard system directories. Initiating process will be powershell.exe. If Sysmon registry monitoring is not deployed, Security Event ID 4657 may capture this if SACL auditing is configured on HKCU\Environment.
- Test 3Search Order Hijacking — Rogue Binary in Application Directory
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Temp\SearchOrderTest\net.exe, Image = cmd.exe or the copy command. Sysmon Event ID 1 (Process Create): Image = C:\Temp\SearchOrderTest\net.exe, initiated from cmd.exe with working directory C:\Temp\SearchOrderTest. Note: Windows 10/11 may resolve the fully qualified system net.exe first; result depends on system configuration and whether CurrentDirectory search order applies.
- Test 4Unquoted Path Privilege Escalation Simulation — Interceptable Path Position
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Program.exe, Image = cmd.exe or the copy command. Security Event ID 4663 (object access) if file system auditing is enabled on C:\. The file creation at C:\ root is unusual and should stand out in file creation baselines — legitimate software rarely creates executable files directly at the root of the system drive.
References (12)
- https://attack.mitre.org/techniques/T1034/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
- https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1034 including response playbook, investigation guide, and atomic red team tests.