Trusted Path Bypass via Windows Directory Spoofing

Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1574.007` Hijack Execution Flow: Path Interception by PATH Environment Variable
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control, `T1574.007` Hijack Execution Flow: Path Interception by PATH Environment Variable
Defense Evasion	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control, `T1574.007` Hijack Execution Flow: Path Interception by PATH Environment Variable

Event coverage

Provider	Event ID	Title
Sysmon	7	Image loaded

Stages and Predicates

Stage 1: `selection`

or:
ImageLoaded|contains: ':\Windows \SysWOW64\'
ImageLoaded|contains: ':\Windows \System32\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.