Unquoted Service Path

An unquoted service path is a Windows service whose executable is registered with a path that contains spaces and no quotes. When the Service Control Manager starts the service, it has to decide where the program name ends and its arguments begin, and for an unquoted path it tries every possible split of the space, left to right, appending .exe. If we can write an executable at one of those intermediate paths, the service will launch it with its privilege level (almost always SYSTEM), not ours.

Mechanism

Take a service with this ImagePath:

C:\Program Files\Some Vendor\Service Runner\service.exe

Because it is not quoted, Windows tries to run, in order:

C:\Program.exe
C:\Program Files\Some.exe
C:\Program Files\Some Vendor\Service.exe
C:\Program Files\Some Vendor\Service Runner\service.exe

The first one that exists wins. If the installer left C:\Program Files\Some Vendor\ writable by normal users (more common than it should be in third-party software), dropping a malicious Service.exe there is enough: on the next restart SYSTEM runs our binary instead of the legitimate one.

Requirements. Three conditions must hold at once, and the one that usually fails is the third: (1) the service path is unquoted and contains spaces, (2) the service runs as a privileged account, and (3) we have write access to one of the intermediate directories and the ability to restart the service (or to wait for a reboot).

How to detect it

winPEAS and PowerUp flag it on their own, but by hand you find it with WMI or sc, filtering the paths that contain a space and do not start with a quote:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

Get-CimInstance win32_service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } | Select Name, PathName, StartName

Then check the candidate directory's write permission with icacls "C:\Program Files\Some Vendor" (look for (W), (M), (F) for our user or for BUILTIN\Users).

The malicious binary is usually a msfvenom -p windows/x64/... -f exe or a small C program that adds a user to the administrators group; it is placed with the name of the winning split and the service is triggered:

sc stop <service> & sc start <service>

Defence. Always register the ImagePath quoted; review the permissions of the C:\Program Files directories so a normal user cannot write to them; and apply least privilege to service accounts. Related to insecure service permissions and scheduled task hijacking.