T1574.009 — Path Interception by Unquoted Path

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path

title: "T1574.009 Hijack Execution Flow: Path Interception by Unquoted Path"
id: 926061ab-603c-4bab-993e-8ccd5aa0f77e
description: 'Detects a service ImagePath registry value being set to a path containing a space without surrounding quotes, the actual condition that enables unquoted-path interception; the previous version matched driver .exe files created under System32\drivers, which does not reflect this technique''s behavior. Tune using: MonitoredServices, SuspiciousBinaryList, TimeWindow, BaselineServiceConfig.'
references:
  - https://attack.mitre.org/techniques/T1574/009
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.009

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\System\CurrentControlSet\Services\'
    TargetObject|endswith: '\ImagePath'
    Details|contains: ' '

  filter_quoted:
    Details|startswith: '"'

  condition: selection and not filter_quoted

falsepositives:
  - Legitimate software installers that configure services with unquoted, space-containing paths (a common misconfiguration, not always malicious); verify the resulting binary and directory permissions before escalating.

level: medium

Related sub-techniques

Explore