Creation Exe for Service with Unquoted Path

Title: Creation Exe for Service with Unquoted Path
Status: test
Description:Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md
Author: frack113
Date: 2021-12-30
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1547.009'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename: 'C:\program.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high