{"id":"T1574.009","name":"Path Interception by Unquoted Path","url":"https://attack.mitre.org/techniques/T1574/009","tactics":["stealth","execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0064","stix_id":"x-mitre-detection-strategy--26a281d7-c49e-4e36-ab51-26a757559cf0","name":"Detection Strategy for Hijack Execution Flow through Path Interception by Unquoted Path","url":"https://attack.mitre.org/detectionstrategies/DET0064","analytics":[{"id":"AN0176","stix_id":"x-mitre-analytic--a972f507-cf1b-4e2f-acdc-877a7891b7cf","name":"Analytic 0176","description":"Unquoted service or shortcut paths that contain spaces and allow path interception by higher-level executables. Defender observes registry service configurations with unquoted paths, file creation of executables in parent directories of unquoted paths, and subsequent process execution from unexpected locations.","url":"https://attack.mitre.org/detectionstrategies/DET0064#AN0176","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredServices","description":"List of critical services to check for unquoted paths in ImagePath registry keys."},{"field":"SuspiciousBinaryList","description":"Executables with names matching potential interception targets (e.g., program.exe, net.exe)."},{"field":"TimeWindow","description":"Correlation interval between file creation in parent directories and execution of unquoted path process."},{"field":"BaselineServiceConfig","description":"Known good service paths for comparison against modified or unquoted values."}],"live":true,"detection_strategies":["DET0064"],"techniques":["T1574.009"]}],"live":true,"version":"1.0","techniques":["T1574.009"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}