t1574-009-path-interception-by-unquoted-path

name	T1574.009_path-interception-by-unquoted-path
description	Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1574.009","persistence","privilege-escalation","defense-evasion","windows","sub-technique"]
technique_id	T1574.009
tactic	persistence
all_tactics	["persistence","privilege-escalation","defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1574/009
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1574","T1574.001","T1574.004","T1574.005","T1574.006","T1574.007","T1574.008","T1574.010","T1574.011","T1574.012","T1574.013","T1574.014"]
prerequisites	["T1574"]
severity_boost	{"T1574":"Chain with T1574 for deeper attack path","T1574.001":"Chain with T1574.001 for deeper attack path","T1574.004":"Chain with T1574.004 for deeper attack path"}

T1574.009 Path Interception by Unquoted Path

Sub-technique of: T1574

High-Level Description

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Service paths and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.

This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)
• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if Path Interception by Unquoted Path technique is applicable to target environment
• Check Windows systems for indicators of Path Interception by Unquoted Path
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Execution of program.exe as service with unquoted service path

When a service is created whose executable path contains spaces and isn’t enclosed within quotes, leads to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. In this case, if an executable program.exe in C:\ exists, C:\program.exe will be executed instead of test.exe in C:\Program Files\subfolder\test.exe.