LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1574.009: Path Interception by Unquoted Path

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Service paths [1] and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [2] (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [3] [4]

This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

EnterpriseT1574.009Sub-techniqueObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

This Windows technique matters because a simple configuration weakness—unquoted executable paths containing spaces—can let an attacker’s program run instead of the intended one. For leaders, the risk is not just malware execution; it is that routine service starts or shortcuts may repeatedly trigger unauthorized code, potentially supporting persistence or privilege escalation when higher-privileged processes launch the vulnerable path.

Executive priority

Prioritize this as a Windows hardening and audit issue, especially on servers, privileged workstations, and systems where services run with elevated rights. The business decision is whether asset owners can prove that service paths and shortcut paths are correctly quoted, writable directories are controlled, and unauthorized execution is constrained. This also supports compliance evidence because the relevant mitigations map to file permission control, execution prevention, and auditing.

Technical view

ATT&CK lists this as a Windows sub-technique under Hijack Execution Flow with stealth and execution tactics. SOC, detection engineering, and IR teams should validate whether Windows service ImagePath values and shortcut targets contain spaces without quotation marks, and whether users or low-privileged principals can write to higher-level directories in those paths. Because ATT&CK provides no official detection text for this object, detection should be built from the related detection strategy context, local Windows telemetry, and configuration auditing rather than assumed coverage. Relationship context also notes PowerSploit and Empire use this technique, so alerts involving those tools should be triaged with checks for vulnerable path configuration and unexpected executable placement.

Likely telemetry

  • Windows Registry data for HKLM\SYSTEM\CurrentControlSet\Services service configuration, especially executable path values
  • File system ACL and ownership data for directories in service and shortcut paths
  • File creation or modification events in higher-level directories that could be resolved before the intended executable path
  • Process creation telemetry showing unexpected executable paths launched by services, scheduled operational activity, or user shortcuts
  • Application control or execution prevention logs for blocked or allowed executables

Detection direction

  • Inventory Windows service and shortcut paths with spaces that are not surrounded by quotation marks; treat findings as exposure requiring validation, not proof of compromise.
  • Correlate vulnerable path findings with directory write permissions to identify cases where non-administrative users or broad groups can place executables in path locations.
  • Tune detections for unexpected executable launches from parent directories in vulnerable paths, while accounting for legitimate administrative tools and software installers that may create noisy file activity.
  • Use process creation and file creation context together; either signal alone may be ambiguous.
  • Review detections in the context of broader Hijack Execution Flow activity and related post-exploitation frameworks named in ATT&CK relationships, without assuming tool presence unless local evidence supports it.

Mitigation priorities

  • Audit Windows services and shortcuts for unquoted paths with spaces and correct the configuration by ensuring paths are properly quoted.
  • Restrict file and directory permissions so users and processes cannot write executables into sensitive or higher-level directories that Windows may resolve first.
  • Implement execution prevention controls to limit unauthorized code execution on Windows systems, prioritizing high-value servers and privileged workstations.
  • Maintain recurring configuration audits so new software installs or operational changes do not reintroduce vulnerable paths.
  • Use audit results as evidence for hardening, least privilege, and compliance readiness programs.
Additional notes and limits

The supplied ATT&CK object identifies the behavior, Windows platform scope, stealth and execution tactics, and relationships to one detection strategy, three mitigations, the parent Hijack Execution Flow technique, and two software entries. The strongest defensive value is in combining configuration assessment with permission review and execution telemetry.

ATT&CK does not provide official detection text for this technique in the supplied fields. The related detection strategy is named but not described here, so specific analytic logic must be developed and validated against the local Windows environment. This summary does not establish active exploitation, attribution, or existing detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Path Interception by Unquoted Path

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Service paths [1] and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). [2] (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. [3] [4]

This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1574Hijack Execution FlowThis object subtechnique of Hijack Execution Flow.
Associated objects

Groups, software, and campaigns

ToolEnterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

mitigates · MitigationM1047: AuditEnterpriseuses · ToolS0194: PowerSploitEnterpriseuses · ToolS0363: EmpireEnterprisesubtechnique of · TechniqueT1574: Hijack Execution FlowEnterprisedetects · Detection StrategyDET0064: Detection Strategy for Hijack Execution Flow through Path Interception by Unquoted PathEnterprisemitigates · MitigationM1038: Execution PreventionEnterprisemitigates · MitigationM1022: Restrict File and Directory PermissionsEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

MitigationEnterprise

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

MitigationEnterprise

M1022: Restrict File and Directory Permissions

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

Enforce Least Privilege Permissions:

- Remove unnecessary write permissions on sensitive files and directories. - Use file ownership and groups to control access for specific roles.

Example (Windows): Right-click the shared folder → Properties → Security tab → Adjust permissions for NTFS ACLs.

Harden File Shares:

- Disable anonymous access to shared folders. - Enforce NTFS permissions for shared folders on Windows.

Example: Set permissions to restrict write access to critical files, such as system executables (e.g., `/bin` or `/sbin` on Linux). Use tools like `chown` and `chmod` to assign file ownership and limit access.

On Linux, apply: `chmod 750 /etc/sensitive.conf` `chown root:admin /etc/sensitive.conf`

File Integrity Monitoring (FIM):

- Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

Audit File System Access:

- Enable auditing to track permission changes or unauthorized access attempts. - Use auditd (Linux) or Event Viewer (Windows) to log activities.

Restrict Startup Directories:

- Configure permissions to prevent unauthorized writes to directories like `C:\ProgramData\Microsoft\Windows\Start Menu`.

Example: Restrict write access to critical directories like `/etc/`, `/usr/local/`, and Windows directories such as `C:\Windows\System32`.

- On Windows, use icacls to modify permissions: `icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F` - On Linux, monitor permissions using tools like `lsattr` or `auditd`.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
17b54599273f2654...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle17b54599273f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft CurrentControlSet Services

    Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020.

    Open source URL
  2. [2]
    Help eliminate unquoted path

    Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.

    Open source URL
  3. [3]
    Windows Unquoted Services

    HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018.

    Open source URL
  4. [4]
    Windows Privilege Escalation Guide

    absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.

    Open source URL
  5. [5]
    Microsoft CreateProcess

    Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.

    Open source URL
  6. [6]
    Microsoft Dynamic-Link Library Security

    Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved July 25, 2016.

    Open source URL
  7. [7]
    Vulnerability and Exploit Detector

    Kanthak, S.. (2016, July 20). Vulnerability and Exploit Detector. Retrieved February 3, 2017.

    Open source URL
  8. [8]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  9. [9]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  10. [10]
    Github PowerShell Empire

    Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.

    Open source URL
  11. [11]
    SANS Application Whitelisting

    Beechey, J.. (2014, November 18). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.

    Open source URL
  12. [12]
    Microsoft Windows Defender Application Control

    Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.

    Open source URL
  13. [13]
    Windows Commands JPCERT

    Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.

    Open source URL
  14. [14]
    NSA MS AppLocker

    NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.

    Open source URL
  15. [15]
    Microsoft Application Lockdown

    Corio, C., & Sayana, D. P.. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.

    Open source URL
  16. [16]
    Microsoft Using Software Restriction

    Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.

    Open source URL
  17. [17]
    Help eliminate unquoted path

    Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.

    Open source URL
  18. [18]
    Help eliminate unquoted path

    Mark Baggett. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved November 8, 2012.

    Open source URL
  19. [19]
    Microsoft CurrentControlSet Services

    Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020.

    Open source URL
  20. [20]
    Microsoft CurrentControlSet Services

    Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020.

    Open source URL
  21. [21]
    Windows Privilege Escalation Guide

    absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.

    Open source URL
  22. [22]
    Windows Privilege Escalation Guide

    absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018.

    Open source URL
  23. [23]
    Windows Unquoted Services

    HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018.

    Open source URL
  24. [24]
    Windows Unquoted Services

    HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018.

    Open source URL
  25. [25]
    mitre-attackT1574.009
    Open source URL
  26. [26]
    mitre-attackT1574.009
    Open source URL
  27. [27]
    mitre-attackT1574.009
    Open source URL
  28. [28]
    Microsoft CreateProcess

    Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.

    Open source URL
  29. [29]
    Microsoft Dynamic-Link Library Security

    Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved July 25, 2016.

    Open source URL
  30. [30]
    Vulnerability and Exploit Detector

    Kanthak, S.. (2016, July 20). Vulnerability and Exploit Detector. Retrieved February 3, 2017.

    Open source URL
  31. [31]
    GitHub PowerSploit May 2012

    PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.

    Open source URL
  32. [32]
    PowerSploit Documentation

    PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.

  33. [33]
    Github PowerShell Empire

    Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.

    Open source URL
  34. [34]
    Microsoft Application Lockdown

    Corio, C., & Sayana, D. P.. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.

    Open source URL
  35. [35]
    Microsoft Using Software Restriction

    Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.

    Open source URL
  36. [36]
    Microsoft Windows Defender Application Control

    Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.

    Open source URL
  37. [37]
    NSA MS AppLocker

    NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.

    Open source URL
  38. [38]
    SANS Application Whitelisting

    Beechey, J.. (2014, November 18). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.

    Open source URL
  39. [39]
    Windows Commands JPCERT

    Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use