Detect Path Interception by Unquoted Path in Splunk
Adversaries exploit unquoted service executable paths that contain spaces. When a service path like C:\Program Files\My Service\service.exe is not quoted, Windows parses it by trying C:\Program.exe, then C:\Program Files\My.exe, then C:\Program Files\My Service\service.exe. An adversary with write access to C:\ or C:\Program Files\ can plant Program.exe or Program Files\My.exe to intercept service startup. This technique achieves privilege escalation because services typically run as SYSTEM. PowerSploit (Get-ServiceUnquoted), Empire, and winPEAS all include unquoted path discovery. It is particularly prevalent in third-party software installations that fail to properly quote service paths.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.009 Path Interception by Unquoted Path
- Canonical reference
- https://attack.mitre.org/techniques/T1574/009/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| where TargetObject like "%\\Services\\%\\ImagePath" OR TargetObject like "%\\Services\\%\\BinPath"
| where match(Details, " ") AND NOT match(Details, "^\"")
| where NOT match(Details, "(?i)C:\\\\Windows")
| eval UnquotedPath=Details
| eval PotentialIntercepts=mvjoin(mvmap(split(mvindex(split(Details, "\\"), 0, -2), "\\"), mvindex(split(Details, "\\"), 0, if(mvfind(split(Details, " "), ".") > 0, mvfind(split(Details, " "), ".") - 1, -1))), "\\")
| table _time, host, User, TargetObject, UnquotedPath, Image
| sort - _time
```
Also detect exploitation (binary planted at interception point):
```
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(lower(Image), "c:\\\\program\.(exe|com)$") OR match(lower(Image), "c:\\\\program files\\\\[^\\\\]+\.(exe|com)$")
| table _time, host, User, Image, CommandLine, ParentImage, IntegrityLevel
| sort - _timeFirst query detects vulnerable service registrations (registry ImagePath values with spaces and no quotes). Second query detects active exploitation — a binary named 'Program.exe' at C:\ or a binary at C:\Program Files\<name>.exe, which are the interception points for unquoted paths starting with 'C:\Program Files'. The exploitation query has much higher fidelity than the vulnerability discovery query.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Vulnerability discovery tools (winPEAS, PowerUp, SharpUp) scanning for unquoted paths — common in legitimate pen tests
- Software installers that create (but immediately fix) unquoted paths
- False positives for C:\Program.exe will be rare but the vulnerability-discovery query has many legitimate triggers
Other platforms for T1574.009
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Vulnerable Service with Unquoted Path
Expected signal: Security Event ID 7045 (System log): Service Installed event for UnquotedTestService. Sysmon Event ID 13 (Registry): HKLM\SYSTEM\CurrentControlSet\Services\UnquotedTestService\ImagePath set to unquoted value. Process creation for sc.exe.
- Test 2Enumerate Unquoted Service Paths (PowerSploit-Style)
Expected signal: PowerShell process creation with WMI query to Win32_Service. Sysmon Event ID 19 (WMI Activity) may log the WMI query. PowerShell ScriptBlock Log Event ID 4104 records the enumeration script.
- Test 3Plant Interception Binary at C:\Program.exe
Expected signal: Sysmon Event ID 11 (FileCreate): C:\Program.exe created at root of C: drive. High-priority alert — any EXE at C:\ root is anomalous. If any service with unquoted 'C:\Program Files' path starts, this binary would execute as SYSTEM.
References (5)
- https://attack.mitre.org/techniques/T1574/009/
- https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464
- https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md
Unlock Pro Content
Get the full detection package for T1574.009 including response playbook, investigation guide, and atomic red team tests.