Detect Path Interception in CrowdStrike LogScale
**Deprecated — superseded by T1574.007 (PATH Environment Variable), T1574.008 (Search Order Hijacking), and T1574.009 (Unquoted Path).** Path Interception occurs when an adversary places an executable in a specific filesystem location so that it is resolved and executed instead of the intended system binary. Three distinct variants are covered: **Unquoted Paths:** Service or shortcut paths containing spaces without surrounding quotation marks allow Windows to attempt higher-level path components first during binary resolution. If a service ImagePath is `C:\Program Files\My App\svc.exe` (unquoted), Windows tries `C:\Program.exe` before reaching the intended binary. Adversaries plant malicious executables at these interceptable positions to run with the service's privilege level on next service start or system restart. **PATH Environment Variable Misconfiguration:** If adversary-controlled directories appear in the PATH environment variable before `C:\Windows\system32`, executables placed there with names matching Windows utilities (cmd.exe, net.exe, powershell.exe) will execute preferentially whenever those tools are invoked without a fully qualified path — from scripts, scheduled tasks, or applications. **Search Order Hijacking:** Windows searches the calling application's directory (and the current working directory for cmd.exe invocations) before system directories when resolving unqualified binary names. Placing a malicious binary named after a system tool in an application's working directory causes it to execute instead of the real utility, enabling both persistence and privilege escalation if the calling application runs elevated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1034/
LogScale Detection Query
// T1034 Path Interception — CrowdStrike LogScale (Falcon Data Replicator)
// Signal 1: System binary name hijack — executed outside canonical Windows device paths
(
#event_simpleName = /^ProcessRollup2$/
| FileName = /(?i)^(cmd|net|net1|powershell|ipconfig|whoami|ping|tasklist|sc|reg|msiexec|wscript|cscript|rundll32|regsvr32|certutil|msbuild|wmic|schtasks|systeminfo|netstat|arp|route|at|bitsadmin)\.exe$/
| ImageFileName != /(?i)\\Device\\HarddiskVolume[0-9]+\\Windows\/
| ImageFileName != /(?i)\\Device\\HarddiskVolume[0-9]+\\Program Files\/
| ImageFileName != /(?i)\\Device\\HarddiskVolume[0-9]+\\Program Files \(x86\)\/
| ImageFileName != /(?i)\\Device\\HarddiskVolume[0-9]+\\ProgramData\\Microsoft\/
| SignalType := "BinaryNameHijack"
| AffectedPath := ImageFileName
| RelevantData := CommandLine
)
// Signal 2: PATH environment variable registry modification to include user-writable location
| union (
#event_simpleName = /^RegSetValue$/
| TargetValueName = /(?i)^Path$/
| (
RegObjectName = /(?i)\\Control\\Session Manager\\Environment/
OR RegObjectName = /(?i)HKCU\\Environment/
OR RegObjectName = /(?i)HKEY_CURRENT_USER\\Environment/
)
| (
RegStringValue = /(?i)C:\\Users\\/
OR RegStringValue = /(?i)C:\\Temp\\/
OR RegStringValue = /(?i)C:\\Windows\\Temp\\/
OR RegStringValue = /(?i)%USERPROFILE%/
OR RegStringValue = /(?i)%TEMP%/
OR RegStringValue = /(?i)%TMP%/
OR RegStringValue = /(?i)%APPDATA%/
)
| SignalType := "PATHEnvironmentHijack"
| AffectedPath := RegObjectName
| RelevantData := RegStringValue
)
// Signal 3: Unquoted service ImagePath containing spaces
| union (
#event_simpleName = /^RegSetValue$/
| TargetValueName = /(?i)^ImagePath$/
| RegObjectName = /(?i)\\Services\\/
| RegStringValue != /^"/
| RegStringValue = /(?i)[A-Za-z]:\\.+ .+\.exe/
| SignalType := "UnquotedServicePath"
| AffectedPath := RegObjectName
| RelevantData := RegStringValue
)
| table([timestamp, ComputerName, UserName, SignalType, AffectedPath, RelevantData, ParentBaseFileName, CommandLine])
| sort(field=timestamp, order=desc)CrowdStrike LogScale (Humio) query using Falcon Data Replicator event stream to detect T1034 Path Interception. Queries ProcessRollup2 events for system binary names executing outside canonical Windows device path prefixes (accommodating Falcon's \Device\HarddiskVolume notation), RegSetValue events for PATH environment registry keys modified to include user-writable paths, and RegSetValue events for service ImagePath keys written without surrounding quotes containing embedded spaces.
Data Sources
Required Tables
False Positives & Tuning
- Authorized adversary simulation exercises using Falcon exclusions where red team operators stage payloads in user-accessible directories using system binary names to test detection coverage
- Software development workflows where build systems (MSBuild, CMake, Bazel) produce executables sharing system utility names (e.g., reg.exe output stubs, net.exe wrappers) in project output directories that are temporarily on PATH
- Legacy enterprise software (HR systems, ERP platforms, OEM hardware utilities) with service installers that have never been updated to quote service paths, a widespread pre-Windows Vista packaging defect that persists in many production environments
Other platforms for T1034
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Unquoted Service Path via Registry
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SYSTEM\CurrentControlSet\Services\df00techVulnSvc\ImagePath, Details = 'C:\Program Files\Vulnerable App\service.exe' (note: no leading quote character). Initiating process will be reg.exe or the calling shell. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2PATH Environment Variable Hijack — Prepend User-Writable Directory
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKEY_CURRENT_USER\Environment\Path, Details contains 'C:\Temp\PathHijackTest' as a prefix before standard system directories. Initiating process will be powershell.exe. If Sysmon registry monitoring is not deployed, Security Event ID 4657 may capture this if SACL auditing is configured on HKCU\Environment.
- Test 3Search Order Hijacking — Rogue Binary in Application Directory
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Temp\SearchOrderTest\net.exe, Image = cmd.exe or the copy command. Sysmon Event ID 1 (Process Create): Image = C:\Temp\SearchOrderTest\net.exe, initiated from cmd.exe with working directory C:\Temp\SearchOrderTest. Note: Windows 10/11 may resolve the fully qualified system net.exe first; result depends on system configuration and whether CurrentDirectory search order applies.
- Test 4Unquoted Path Privilege Escalation Simulation — Interceptable Path Position
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Program.exe, Image = cmd.exe or the copy command. Security Event ID 4663 (object access) if file system auditing is enabled on C:\. The file creation at C:\ root is unusual and should stand out in file creation baselines — legitimate software rarely creates executable files directly at the root of the system drive.
References (12)
- https://attack.mitre.org/techniques/T1034/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
- https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1034 including response playbook, investigation guide, and atomic red team tests.