Path Interception by Unquoted Path
Adversaries exploit unquoted service executable paths that contain spaces. When a service path like C:\Program Files\My Service\service.exe is not quoted, Windows parses it by trying C:\Program.exe, then C:\Program Files\My.exe, then C:\Program Files\My Service\service.exe. An adversary with write access to C:\ or C:\Program Files\ can plant Program.exe or Program Files\My.exe to intercept service startup. This technique achieves privilege escalation because services typically run as SYSTEM. PowerSploit (Get-ServiceUnquoted), Empire, and winPEAS all include unquoted path discovery. It is particularly prevalent in third-party software installations that fail to properly quote service paths.
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName in~ ("ImagePath", "BinPath")
| where RegistryValueData has " "
| where not(RegistryValueData startswith '"')
| where not(RegistryValueData startswith "C:\\Windows")
| where RegistryValueData matches regex @'^[A-Z]:\\(?!")'
| extend ServicePath = RegistryValueData
| extend HasSpace = ServicePath has " "
| extend IsQuoted = ServicePath startswith '"'
| where HasSpace and not(IsQuoted)
| project Timestamp, DeviceName, AccountName, RegistryKey,
ServicePath, InitiatingProcessFileName
| sort by Timestamp descData Sources
Required Tables
False Positives
- Many third-party software installations legitimately create services with unquoted paths containing spaces — this is a widespread misconfiguration rather than always malicious
- Some legacy applications installed before secure coding practices were common have unquoted paths
- Enterprise software that has not been updated to fix this misconfiguration
- Software deployers that don't validate path quoting during installation
References (5)
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
Unlock Pro Content
Get the full detection package for T1574.009 including response playbook, investigation guide, and atomic red team tests.