T1574.009: Path Interception by Unquoted Path
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Service paths [1] and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [2] (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [3] [4]
This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
Analyst context for executives and security teams
This Windows technique matters because a simple configuration weakness—unquoted executable paths containing spaces—can let an attacker’s program run instead of the intended one. For leaders, the risk is not just malware execution; it is that routine service starts or shortcuts may repeatedly trigger unauthorized code, potentially supporting persistence or privilege escalation when higher-privileged processes launch the vulnerable path.
Executive priority
Prioritize this as a Windows hardening and audit issue, especially on servers, privileged workstations, and systems where services run with elevated rights. The business decision is whether asset owners can prove that service paths and shortcut paths are correctly quoted, writable directories are controlled, and unauthorized execution is constrained. This also supports compliance evidence because the relevant mitigations map to file permission control, execution prevention, and auditing.
Technical view
ATT&CK lists this as a Windows sub-technique under Hijack Execution Flow with stealth and execution tactics. SOC, detection engineering, and IR teams should validate whether Windows service ImagePath values and shortcut targets contain spaces without quotation marks, and whether users or low-privileged principals can write to higher-level directories in those paths. Because ATT&CK provides no official detection text for this object, detection should be built from the related detection strategy context, local Windows telemetry, and configuration auditing rather than assumed coverage. Relationship context also notes PowerSploit and Empire use this technique, so alerts involving those tools should be triaged with checks for vulnerable path configuration and unexpected executable placement.
Likely telemetry
- Windows Registry data for HKLM\SYSTEM\CurrentControlSet\Services service configuration, especially executable path values
- File system ACL and ownership data for directories in service and shortcut paths
- File creation or modification events in higher-level directories that could be resolved before the intended executable path
- Process creation telemetry showing unexpected executable paths launched by services, scheduled operational activity, or user shortcuts
- Application control or execution prevention logs for blocked or allowed executables
Detection direction
- Inventory Windows service and shortcut paths with spaces that are not surrounded by quotation marks; treat findings as exposure requiring validation, not proof of compromise.
- Correlate vulnerable path findings with directory write permissions to identify cases where non-administrative users or broad groups can place executables in path locations.
- Tune detections for unexpected executable launches from parent directories in vulnerable paths, while accounting for legitimate administrative tools and software installers that may create noisy file activity.
- Use process creation and file creation context together; either signal alone may be ambiguous.
- Review detections in the context of broader Hijack Execution Flow activity and related post-exploitation frameworks named in ATT&CK relationships, without assuming tool presence unless local evidence supports it.
Mitigation priorities
- Audit Windows services and shortcuts for unquoted paths with spaces and correct the configuration by ensuring paths are properly quoted.
- Restrict file and directory permissions so users and processes cannot write executables into sensitive or higher-level directories that Windows may resolve first.
- Implement execution prevention controls to limit unauthorized code execution on Windows systems, prioritizing high-value servers and privileged workstations.
- Maintain recurring configuration audits so new software installs or operational changes do not reintroduce vulnerable paths.
- Use audit results as evidence for hardening, least privilege, and compliance readiness programs.
Analyst notes and limits
The supplied ATT&CK object identifies the behavior, Windows platform scope, stealth and execution tactics, and relationships to one detection strategy, three mitigations, the parent Hijack Execution Flow technique, and two software entries. The strongest defensive value is in combining configuration assessment with permission review and execution telemetry.
ATT&CK does not provide official detection text for this technique in the supplied fields. The related detection strategy is named but not described here, so specific analytic logic must be developed and validated against the local Windows environment. This summary does not establish active exploitation, attribution, or existing detection coverage.
Path Interception by Unquoted Path
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Service paths [1] and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [2] (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [3] [4]
This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1574 | Hijack Execution Flow | This object subtechnique of Hijack Execution Flow. |
Groups, software, and campaigns
S0194: PowerSploit
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 17b54599273f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft CurrentControlSet Services
Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020.
Open source URL -
[2]
Help eliminate unquoted path
Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.
Open source URL -
[3]
Windows Unquoted Services
HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018.
Open source URL -
[4]
Windows Privilege Escalation Guide
absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.
Open source URL -
[5]
mitre-attack T1574.009Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.