Detect Path Interception by Unquoted Path in Microsoft Sentinel
Adversaries exploit unquoted service executable paths that contain spaces. When a service path like C:\Program Files\My Service\service.exe is not quoted, Windows parses it by trying C:\Program.exe, then C:\Program Files\My.exe, then C:\Program Files\My Service\service.exe. An adversary with write access to C:\ or C:\Program Files\ can plant Program.exe or Program Files\My.exe to intercept service startup. This technique achieves privilege escalation because services typically run as SYSTEM. PowerSploit (Get-ServiceUnquoted), Empire, and winPEAS all include unquoted path discovery. It is particularly prevalent in third-party software installations that fail to properly quote service paths.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.009 Path Interception by Unquoted Path
- Canonical reference
- https://attack.mitre.org/techniques/T1574/009/
KQL Detection Query
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName in~ ("ImagePath", "BinPath")
| where RegistryValueData has " "
| where not(RegistryValueData startswith '"')
| where not(RegistryValueData startswith "C:\\Windows")
| where RegistryValueData matches regex @'^[A-Z]:\\(?!")'
| extend ServicePath = RegistryValueData
| extend HasSpace = ServicePath has " "
| extend IsQuoted = ServicePath startswith '"'
| where HasSpace and not(IsQuoted)
| project Timestamp, DeviceName, AccountName, RegistryKey,
ServicePath, InitiatingProcessFileName
| sort by Timestamp descDetects service registry entries with unquoted paths containing spaces — the pre-condition for unquoted path interception attacks. Monitors the Services registry hive for ImagePath/BinPath values that contain spaces but lack surrounding quotes. While this detects the vulnerability rather than active exploitation, new vulnerable service registrations are high-priority findings, especially those created or modified by non-trusted processes.
Data Sources
Required Tables
False Positives & Tuning
- Many third-party software installations legitimately create services with unquoted paths containing spaces — this is a widespread misconfiguration rather than always malicious
- Some legacy applications installed before secure coding practices were common have unquoted paths
- Enterprise software that has not been updated to fix this misconfiguration
- Software deployers that don't validate path quoting during installation
Other platforms for T1574.009
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Service with Unquoted Path
Expected signal: Security Event ID 7045 (System log): Service Installed event for UnquotedTestService. Sysmon Event ID 13 (Registry): HKLM\SYSTEM\CurrentControlSet\Services\UnquotedTestService\ImagePath set to unquoted value. Process creation for sc.exe.
- Test 2Enumerate Unquoted Service Paths (PowerSploit-Style)
Expected signal: PowerShell process creation with WMI query to Win32_Service. Sysmon Event ID 19 (WMI Activity) may log the WMI query. PowerShell ScriptBlock Log Event ID 4104 records the enumeration script.
- Test 3Plant Interception Binary at C:\Program.exe
Expected signal: Sysmon Event ID 11 (FileCreate): C:\Program.exe created at root of C: drive. High-priority alert — any EXE at C:\ root is anomalous. If any service with unquoted 'C:\Program Files' path starts, this binary would execute as SYSTEM.
References (5)
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
Unlock Pro Content
Get the full detection package for T1574.009 including response playbook, investigation guide, and atomic red team tests.