Detect Path Interception in Splunk
**Deprecated — superseded by T1574.007 (PATH Environment Variable), T1574.008 (Search Order Hijacking), and T1574.009 (Unquoted Path).** Path Interception occurs when an adversary places an executable in a specific filesystem location so that it is resolved and executed instead of the intended system binary. Three distinct variants are covered: **Unquoted Paths:** Service or shortcut paths containing spaces without surrounding quotation marks allow Windows to attempt higher-level path components first during binary resolution. If a service ImagePath is `C:\Program Files\My App\svc.exe` (unquoted), Windows tries `C:\Program.exe` before reaching the intended binary. Adversaries plant malicious executables at these interceptable positions to run with the service's privilege level on next service start or system restart. **PATH Environment Variable Misconfiguration:** If adversary-controlled directories appear in the PATH environment variable before `C:\Windows\system32`, executables placed there with names matching Windows utilities (cmd.exe, net.exe, powershell.exe) will execute preferentially whenever those tools are invoked without a fully qualified path — from scripts, scheduled tasks, or applications. **Search Order Hijacking:** Windows searches the calling application's directory (and the current working directory for cmd.exe invocations) before system directories when resolving unqualified binary names. Placing a malicious binary named after a system tool in an application's working directory causes it to execute instead of the real utility, enabling both persistence and privilege escalation if the calling application runs elevated.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1034/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
(EventCode=1
(Image="*\\cmd.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR
Image="*\\powershell.exe" OR Image="*\\whoami.exe" OR Image="*\\ping.exe" OR
Image="*\\sc.exe" OR Image="*\\reg.exe" OR Image="*\\certutil.exe" OR
Image="*\\msiexec.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR
Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\schtasks.exe" OR
Image="*\\systeminfo.exe" OR Image="*\\netstat.exe" OR Image="*\\bitsadmin.exe")
NOT (Image="C:\\Windows\\*" OR Image="C:\\Program Files\\*" OR
Image="C:\\Program Files (x86)\\*" OR Image="C:\\ProgramData\\Microsoft\\*"))
OR
(EventCode=13
(TargetObject="*\\Control\\Session Manager\\Environment\\Path" OR
TargetObject="*HKCU\\Environment\\Path" OR
TargetObject="*HKEY_CURRENT_USER\\Environment\\Path")
(Details="*C:\\Users\\*" OR Details="*%USERPROFILE%*" OR Details="*%TEMP%*" OR
Details="*%TMP%*" OR Details="*C:\\Temp\\*" OR Details="*%APPDATA%*"))
OR
(EventCode=13
TargetObject="*\\Services\\*\\ImagePath"
NOT Details="\"*"
(Details="*Program Files*" OR Details="* *.exe"))
)
| eval SignalType=case(
EventCode="1", "BinaryNameHijack",
EventCode="13" AND match(TargetObject, "(?i)Environment.*Path$"), "PATHEnvironmentModification",
EventCode="13" AND match(TargetObject, "(?i)\\\\Services\\\\"), "UnquotedServicePath",
true(), "Unknown")
| eval AffectedPath=coalesce(Image, TargetObject)
| eval RelevantData=coalesce(CommandLine, Details)
| eval IsUnquotedPath=if(SignalType="UnquotedServicePath" AND match(RelevantData, "^[^\"]"), 1, 0)
| table _time, host, User, SignalType, AffectedPath, RelevantData, ParentImage, ParentCommandLine, IsUnquotedPath
| sort - _timeThree-branch Sysmon-based detection covering all path interception variants. Branch 1 (EventCode=1, Process Create) flags system binary names executing from outside C:\Windows\, Program Files, or ProgramData\Microsoft — indicating search order hijacking or PATH variable abuse. Branch 2 (EventCode=13, RegistryValueSet) identifies modifications to HKLM System or HKCU PATH values that introduce user-writable directories (C:\Users\, %TEMP%, etc.), enabling future binary shadowing. Branch 3 (EventCode=13) catches service ImagePath writes that lack surrounding quotes and contain spaces, marking unquoted path vulnerabilities. Results are tagged by SignalType and the IsUnquotedPath flag aids triage for the service variant.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Portable application suites that ship their own versions of cmd.exe, net.exe, or powershell.exe in non-standard installation directories
- Software installers temporarily modifying PATH to include installation staging directories, reverting after setup completes
- Configuration management tools (Chef, Puppet, Ansible) creating service entries programmatically with transient unquoted ImagePath values
- Virtualisation and container software prepending shim directories to PATH as an intentional design feature for tool override
Other platforms for T1034
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Unquoted Service Path via Registry
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKLM\SYSTEM\CurrentControlSet\Services\df00techVulnSvc\ImagePath, Details = 'C:\Program Files\Vulnerable App\service.exe' (note: no leading quote character). Initiating process will be reg.exe or the calling shell. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2PATH Environment Variable Hijack — Prepend User-Writable Directory
Expected signal: Sysmon Event ID 13 (RegistryValueSet): TargetObject = HKEY_CURRENT_USER\Environment\Path, Details contains 'C:\Temp\PathHijackTest' as a prefix before standard system directories. Initiating process will be powershell.exe. If Sysmon registry monitoring is not deployed, Security Event ID 4657 may capture this if SACL auditing is configured on HKCU\Environment.
- Test 3Search Order Hijacking — Rogue Binary in Application Directory
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Temp\SearchOrderTest\net.exe, Image = cmd.exe or the copy command. Sysmon Event ID 1 (Process Create): Image = C:\Temp\SearchOrderTest\net.exe, initiated from cmd.exe with working directory C:\Temp\SearchOrderTest. Note: Windows 10/11 may resolve the fully qualified system net.exe first; result depends on system configuration and whether CurrentDirectory search order applies.
- Test 4Unquoted Path Privilege Escalation Simulation — Interceptable Path Position
Expected signal: Sysmon Event ID 11 (FileCreate): TargetFilename = C:\Program.exe, Image = cmd.exe or the copy command. Security Event ID 4663 (object access) if file system auditing is enabled on C:\. The file creation at C:\ root is unusual and should stand out in file creation baselines — legitimate software rarely creates executable files directly at the root of the system drive.
References (12)
- https://attack.mitre.org/techniques/T1034/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://www.sploitspren.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://blogs.technet.microsoft.com/srd/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file/
- https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set
Unlock Pro Content
Get the full detection package for T1034 including response playbook, investigation guide, and atomic red team tests.