Service Search Path Interception

Hypothesis and description

According to ATT&CK, an adversary may escalate privileges by intercepting the search path for legitimately installed services. As a result, Windows will launch the target executable instead of the desired binary and command line. This can be done when there are spaces in the binary path and the path is unquoted. Search path interception should never happen legitimately and will likely be the result of an adversary abusing a system misconfiguration. With a few regular expressions, it is possible to identify the execution of services with intercepted search paths.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2014-07-17
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1574 Hijack Execution FlowT1574.009	Privilege Escalation, Persistence	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1574Hijack Execution Flow
.009 Path Interception by Unquoted Path

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Look over all service creations that have a quoted path for the first argument. Assuming these still have an absolute path, look for cases in which the command line has a space, but the exe field is not part of the command line. This would indicate that a different process was intended, but the path was intercepted at an earlier space.

process = search Process:Create
services = filter processes where (parent_exe == "services.exe")
unquoted_services = filter services where (command_line != "\"*" and command_line == "* *")
intercepted_service = filter unquoted_service where (image_path != "* *" and exe not in command_line)
output intercepted_service

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

12 more in the full list

View CAR-2014-07-001 on car.mitre.org

TTPCAR-2014-07-001