Detect Path Interception in Microsoft Sentinel
**Deprecated — superseded by T1574.007 (PATH Environment Variable), T1574.008 (Search Order Hijacking), and T1574.009 (Unquoted Path).** Path Interception occurs when an adversary places an executable in a specific filesystem location so that it is resolved and executed instead of the intended system binary. Three distinct variants are covered: **Unquoted Paths:** Service or shortcut paths containing spaces without surrounding quotation marks allow Windows to attempt higher-level path components first during binary resolution. If a service ImagePath is `C:\Program Files\My App\svc.exe` (unquoted), Windows tries `C:\Program.exe` before reaching the intended binary. Adversaries plant malicious executables at these interceptable positions to run with the service's privilege level on next service start or system restart. **PATH Environment Variable Misconfiguration:** If adversary-controlled directories appear in the PATH environment variable before `C:\Windows\system32`, executables placed there with names matching Windows utilities (cmd.exe, net.exe, powershell.exe) will execute preferentially whenever those tools are invoked without a fully qualified path — from scripts, scheduled tasks, or applications. **Search Order Hijacking:** Windows searches the calling application's directory (and the current working directory for cmd.exe invocations) before system directories when resolving unqualified binary names. Placing a malicious binary named after a system tool in an application's working directory causes it to execute instead of the real utility, enabling both persistence and privilege escalation if the calling application runs elevated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1034/
KQL Detection Query
let SystemBinaryNames = dynamic([
"cmd.exe", "net.exe", "net1.exe", "powershell.exe", "ipconfig.exe",
"whoami.exe", "ping.exe", "tasklist.exe", "sc.exe", "reg.exe",
"msiexec.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe",
"certutil.exe", "msbuild.exe", "wmic.exe", "schtasks.exe", "systeminfo.exe",
"netstat.exe", "arp.exe", "route.exe", "at.exe", "bitsadmin.exe"
]);
// Signal 1: System binary name executed from outside canonical Windows directories
let BinaryNameHijack = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (SystemBinaryNames)
| where not (
FolderPath startswith @"C:\Windows\"
or FolderPath startswith @"C:\Program Files\"
or FolderPath startswith @"C:\Program Files (x86)\"
or FolderPath startswith @"C:\ProgramData\Microsoft\Windows Defender\"
or FolderPath =~ @"C:\"
)
| extend Signal = "BinaryNameHijack",
RiskContext = strcat("Process: ", FolderPath, "\\", FileName, " | Parent: ", InitiatingProcessFileName);
// Signal 2: PATH environment variable written to include user-writable or temp directory
let PathModification = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"Control\Session Manager\Environment"
or RegistryKey has @"HKEY_CURRENT_USER\Environment"
| where RegistryValueName =~ "Path"
| where RegistryValueData has_any (
@"C:\Users\", @"C:\Temp\", @"C:\ProgramData\",
"%USERPROFILE%", "%TEMP%", "%TMP%", "%APPDATA%",
@"C:\Windows\Temp\"
)
| extend Signal = "PATHEnvironmentHijack",
RiskContext = strcat("New PATH value: ", RegistryValueData);
// Signal 3: Service ImagePath written without quotes containing spaces (unquoted service path)
let UnquotedServicePath = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"\Services\"
| where RegistryValueName =~ "ImagePath"
| where RegistryValueData !startswith "\""
| where RegistryValueData matches regex @"[A-Za-z]:\\.+\s.+\.exe"
| extend Signal = "UnquotedServicePath",
RiskContext = strcat("Unquoted ImagePath: ", RegistryValueData);
// Union all path interception signals with consistent schema
union
(BinaryNameHijack
| project Timestamp, DeviceName, AccountName, Signal, RiskContext,
AffectedPath = FolderPath,
ExecutionDetail = ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine),
(PathModification
| project Timestamp, DeviceName,
AccountName = InitiatingProcessAccountName, Signal, RiskContext,
AffectedPath = RegistryKey,
ExecutionDetail = RegistryValueData,
InitiatingProcessFileName, InitiatingProcessCommandLine),
(UnquotedServicePath
| project Timestamp, DeviceName,
AccountName = InitiatingProcessAccountName, Signal, RiskContext,
AffectedPath = RegistryKey,
ExecutionDetail = RegistryValueData,
InitiatingProcessFileName, InitiatingProcessCommandLine)
| sort by Timestamp descThree-signal detection covering all path interception variants using MDE tables. Signal 1 (BinaryNameHijack) uses DeviceProcessEvents to identify Windows system binary names (cmd.exe, net.exe, powershell.exe, etc.) executing from outside canonical directories (C:\Windows\, Program Files, ProgramData\Microsoft) — the hallmark of search order hijacking or PATH prepend abuse. Signal 2 (PATHEnvironmentHijack) uses DeviceRegistryEvents to detect writes to HKLM or HKCU PATH values that introduce user-writable or temp directories, creating a future binary shadowing opportunity. Signal 3 (UnquotedServicePath) catches service ImagePath registry writes that omit quotation marks around paths containing spaces, leaving the service vulnerable to interception at the next restart.
Data Sources
Required Tables
False Positives & Tuning
- Portable application suites (development toolchains, embedded Python/Perl distributions, security scanner bundles) that ship their own cmd.exe, net.exe, or powershell.exe stubs in non-standard install directories
- Software installers that temporarily prepend their bin or temp directory to PATH during installation and revert on completion — generates transient PATHEnvironmentHijack signals
- Configuration management tools (Chef, Puppet, Ansible WinRM, SCCM) that create service registry entries programmatically, sometimes producing transient unquoted ImagePath values before a subsequent fixup write
- Virtualisation and container software (Docker Desktop, VirtualBox, WSL2) that intentionally prepend shim directories to PATH to intercept and redirect tool invocations as a designed feature
Other platforms for T1034
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Unquoted Service Path via Registry
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SYSTEM\CurrentControlSet\Services\df00techVulnSvc\ImagePath, Details = 'C:\Program Files\Vulnerable App\service.exe' (note: no leading quote character). Initiating process will be reg.exe or the calling shell. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2PATH Environment Variable Hijack — Prepend User-Writable Directory
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKEY_CURRENT_USER\Environment\Path, Details contains 'C:\Temp\PathHijackTest' as a prefix before standard system directories. Initiating process will be powershell.exe. If Sysmon registry monitoring is not deployed, Security Event ID 4657 may capture this if SACL auditing is configured on HKCU\Environment.
- Test 3Search Order Hijacking — Rogue Binary in Application Directory
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Temp\SearchOrderTest\net.exe, Image = cmd.exe or the copy command. Sysmon Event ID 1 (Process Create): Image = C:\Temp\SearchOrderTest\net.exe, initiated from cmd.exe with working directory C:\Temp\SearchOrderTest. Note: Windows 10/11 may resolve the fully qualified system net.exe first; result depends on system configuration and whether CurrentDirectory search order applies.
- Test 4Unquoted Path Privilege Escalation Simulation — Interceptable Path Position
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Program.exe, Image = cmd.exe or the copy command. Security Event ID 4663 (object access) if file system auditing is enabled on C:\. The file creation at C:\ root is unusual and should stand out in file creation baselines — legitimate software rarely creates executable files directly at the root of the system drive.
References (12)
- https://attack.mitre.org/techniques/T1034/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
- https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1034 including response playbook, investigation guide, and atomic red team tests.