Path Interception by Unquoted Path (T1574.009) is a Windows technique in the stealth and execution tactics. The adversary takes advantage of file paths that contain spaces and lack surrounding quotation marks.
How attackers use it
When a path with a space is not quoted, Windows can read it in pieces and choose an executable higher in the path than the one intended. Service paths and shortcut paths, stored in Registry keys, can both be affected.
MITRE contrasts two forms. This one is vulnerable: C:\unsafe path with space\program.exe. This one is safe: "C:\safe path with space\program.exe". With the unquoted form, an adversary can place an executable in a higher level directory of the path, and Windows resolves that one.
A second MITRE example: a shortcut points to C:\program files\myapp.exe. An adversary creates a program at C:\program.exe, and that runs instead.
Impact depends on who launches it. MITRE says this can give persistence if the executable is called regularly, and privilege escalation if a higher-privileged process starts the intercepted executable.
How to detect it
MITRE's analytic names three observable things: service configurations in the registry with unquoted paths, creation of executables in parent directories of those unquoted paths, and later process execution from unexpected locations.
The first is a configuration audit you can run today. The other two are file and process monitoring.
How to reduce the risk
- Audit. Find and eliminate path interception weaknesses in configuration files, scripts, PATH, services and shortcuts by quoting paths where the function allows. Use fully qualified paths where appropriate. MITRE also suggests cleaning up old Registry keys when software is uninstalled, so no references to missing files remain.
- Execution prevention. Block execution of binaries from unexpected locations with application control such as Windows Defender Application Control, AppLocker or Software Restriction Policies.
- Restrict file and directory permissions. Prevent users from writing to the top-level C: directory and system directories, and require executables to live in write-protected directories.
Check your own environment
# Windows PowerShell: list services whose path has a space but does not start with a quote
Get-CimInstance Win32_Service |
Where-Object { $_.PathName -and $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } |
Select-Object Name,PathName
Some results will be false positives, for example a path with no spaces before the first argument. Review each one. For a real hit, the fix is to correct the service's path value with quotes through your normal change process.
- Can any standard user create files at the root of the system drive?
- Do your software packages register services with quoted paths?
- Do old uninstalled products leave service keys behind?
Quick check
Why does a missing quote matter?
Windows can resolve a shorter path inside the unquoted string, for example C:\program.exe, so an executable planted higher up runs instead of the intended one.
