Executable created at an unquoted service path interception point

Siemphony@siemphonyhighT1574.009unverified

Matches the file-creation leg of AN0176: an executable written to one of the fixed locations Windows probes when it resolves an unquoted service or shortcut path containing spaces. CreateProcess splits such a path on each space and tries every prefix in turn, appending `.exe` when the prefix has no extension, so `C:\Program Files\Common Files\Vendor\svc.exe` written without quotes is attempted first as `C:\Program.exe`, then as `C:\Program Files\Common.exe`, and only then as the intended binary. The prefix ends at each space, not at each path component, which is why anything under `C:\Program Files (x86)\` yields a second drive-root probe at `C:\Program Files.exe` — the same write permission as `C:\Program.exe` buys the adversary the whole x86 tree, so both roots are listed. Those prefixes are a short, closed list on a stock Windows install, which is why this rule enumerates the interception points themselves rather than trying to find the vulnerable service configuration — MITRE's `MonitoredServices` and `BaselineServiceConfig` knobs both require a per-host inventory of ImagePath values compared against a known-good baseline, and lib/sigma has neither a join nor a stored baseline to compare against. The `SuspiciousBinaryList` knob is what the filename list implements, populated here from the prefixes Windows actually probes rather than taken from MITRE. Each entry is anchored with `endswith` on `:\` or on the `Program Files` folder name so a drive root is required: `C:\Program.exe` matches, `C:\Tools\Program.exe` does not, and the anchor works on a system drive other than C:. Only `.exe` is listed because CreateProcess appends only that extension to an extensionless prefix, so a `Program.com` or `Program.bat` at the drive root is not an interception target and is deliberately absent. Scope and limits. This sees the payload being planted, not the hijack firing; the execution half of the analytic — the intercepted process starting from the unexpected location, within MITRE's `TimeWindow` knob — is a separate Sysmon EventID 1 record and a cross-event correlation this rule cannot express. It also sees only the standard prefixes: a service installed under a bespoke unquoted path such as `C:\My App\bin\svc.exe` creates an interception point at `C:\My.exe` that no static list can anticipate, and a site with such services should extend the list from its own ImagePath inventory. The brief's registry source is not used here: it maps Security EventID 4657 onto the Sigma `registry_set` category, and detecting the vulnerable configuration itself would need "ImagePath value contains a space before the extension and does not begin with a quote", which is a structural test on the value rather than a match on it. Prerequisite: Sysmon FileCreate is an allowlist in every mainstream configuration, and the drive root and the Program Files roots are not always in it, so confirm they are in scope before reading an empty result as an absence of this technique. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0064, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (FolderPath endswith ":\\Program.exe" or FolderPath endswith ":\\Program Files.exe" or FolderPath endswith ":\\Documents.exe" or FolderPath endswith "\\Program Files\\Common.exe" or FolderPath endswith "\\Program Files (x86)\\Common.exe")

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*:\\Program.exe" OR TargetFilename="*:\\Program Files.exe" OR TargetFilename="*:\\Documents.exe" OR TargetFilename="*\\Program Files\\Common.exe" OR TargetFilename="*\\Program Files (x86)\\Common.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*:\\\\program.exe" OR TO_LOWER(file.path) LIKE "*:\\\\program files.exe" OR TO_LOWER(file.path) LIKE "*:\\\\documents.exe" OR TO_LOWER(file.path) LIKE "*\\\\program files\\\\common.exe" OR TO_LOWER(file.path) LIKE "*\\\\program files (x86)\\\\common.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(:\\Program\.exe$|:\\Program Files\.exe$|:\\Documents\.exe$|\\Program Files\\Common\.exe$|\\Program Files \(x86\)\\Common\.exe$)</field>    <description>Executable created at an unquoted service path interception point</description>    <mitre>      <id>T1574.009</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e5ce1763-d298-420a-a68b-32951ac5ff04

ATT&CKT1574.009

T1574.009Path Interception by Unquoted Path

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A file being created at one of the fixed locations Windows probes when it resolves an unquoted service or shortcut path. This is the planting half of AN0176, not the hijack firing. When a service ImagePath such as C:\Program Files\Common Files\Vendor\svc.exe is stored without quotes, CreateProcess splits it at each space and tries every prefix in turn, appending .exe where the prefix has no extension. It attempts C:\Program.exe, then C:\Program Files\Common.exe, and only then the intended binary. Whoever can write those names owns the service.

02 · Telemetry you need

Sysmon FileCreate (EventID 11) under the Sigma file_event category on Windows, copied from the brief. The brief also offers registry_set, process_creation and create_stream_hash; this rule uses only the file source. Sysmon's FileCreate is an allowlist in every mainstream configuration, and the drive root and the Program Files roots are often not in it. If they are not, the rule returns zero rows, and zero rows reads as quiet when it means blind. Confirm the paths are in scope before trusting an empty result.

03 · How the logic works

One selection block, selection_interception_point, tests TargetFilename|endswith against five strings: :\Program.exe, :\Program Files.exe, :\Documents.exe, \Program Files\Common.exe and \Program Files (x86)\Common.exe. The condition is that block alone. The subtlety is that the prefix ends at each space, not at each path component. Anything under C:\Program Files (x86)\ therefore yields a second drive-root probe at C:\Program Files.exe — never at C:\Program Files (x86).exe, which Windows does not try. Omitting that term would leave the whole x86 tree, where most vulnerable third-party services live, open for the same write permission. The first three terms are anchored on :\, so a drive root is required and C:\Tools\Program.exe does not match; the anchor works on any volume letter. Only .exe is listed because CreateProcess appends only that extension. MITRE's SuspiciousBinaryList knob is what the filename list implements, but the values are the pipeline's own, read off the probe order rather than given by the analytic. MITRE's MonitoredServices and BaselineServiceConfig knobs go unused: both need a per-host ImagePath inventory compared to a known-good baseline, and lib/sigma has neither a join nor stored state. The TimeWindow knob belongs to the execution half — the intercepted process starting from an unexpected location — a separate EventID 1 record this rule cannot reach.

04 · Common false positives

The loudest source is remediation tooling running the technique in reverse. A documented mitigation is to pre-create a benign, ACL-locked stub at C:\Program.exe so no attacker can claim the name, and vulnerability-remediation scripts and some endpoint baselines ship it. That write is indistinguishable from the malicious one on this event alone. Then purple-team runs, including the Atomic Red Team test for this technique; archive extraction or a download directory landing a file at the drive root; and backup or imaging software replaying a volume that already held one of these files.

05 · Detection maturity

tier_1: Lowest tier, and it stays there. This rule is machine-derived from DET0064 and has never been executed against a single log line. It has no measured true- or false-positive rate, no confirmed field coverage and no operational history — none of the evidence any higher maturity tier requires. Run it against real Sysmon data, record what it fires on, and only then judge where it sits.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Deal with the stub case first: if your estate applied the pre-created-stub remediation, allowlist it by hash and SYSTEM context, or you get one alert per host. The rule ships at level: high, and adversarial review flagged that as sitting against a first false positive that claims per-host volume — the sibling T1574.012 rule dropped to medium on the same test. Treat high as provisional. Extend the filename list from your own ImagePath inventory: a bespoke path like C:\My App\bin\svc.exe creates an interception point at C:\My.exe that no static list anticipates. :\Documents.exe is a legacy-only term and a candidate to drop. Finally, the two Program Files terms are anchored on the folder name only, so D:\Backup\Program Files\Common.exe matches even though no interception point exists there.

Declared by the author

Hardening and remediation tooling doing exactly what this technique abuses, in reverse. A documented mitigation for unquoted service paths is to pre-create a benign, ACL-locked stub at C:\Program.exe so no attacker can claim the name, and vulnerability-remediation scripts and some endpoint baselines ship this. The write is indistinguishable from the malicious one on this event alone; it happens once per host, usually during a build or a patch window and under SYSTEM.
Purple-team and detection-validation runs, including the Atomic Red Team test for this technique, which drops an executable at C:\Program.exe and deletes it seconds later. These arrive as a create-then-delete pair on a known test host.
Archive extraction to the drive root. Unpacking a zip or a self-extracting installer whose top-level entry happens to be Program.exe into C:\ produces a matching create, as does a browser or download manager configured with C:\ as its download directory saving a file of that name.
Backup, restore and disk-imaging software replaying a volume that already contained one of these files, which recreates the original write on a new host without any new adversary action having taken place.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1574.009, evaluated against their file_event events.

Share this rule

/u/siemphony/e5ce1763-d298-420a-a68b-32951ac5ff04

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@owen-mackay
25 Aug 2026
The mitigation-stub false positive is my favourite one in this whole corpus: the recommended hardening for unquoted service paths is to pre-create a benign, ACL-locked C:\Program.exe so no attacker can claim the name — and your detection fires on the remediation. It happens once per host, under SYSTEM, during a build window, so it brackets easily, but only if you know it is coming. We did not, the first time.
- @priya-raman
  25 Aug 2026
  And the Atomic test for this drops the file and deletes it seconds later, exactly as the create-then-delete pair the description mentions. If you run Atomics on a schedule, exclude the test host explicitly. Otherwise you spend a quarter training your analysts that this alert is always the test, and then it is not.

Executable created at an unquoted service path interception point

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread