Unable to Add Quotes to ImagePath for Microsoft Defender Services (Sense and DefenderUpdateSvc) - Unquoted Service Path Vulnerability

And here we go again...

I had written a response to a similar set of issues back in November 2023 that also affected a different Microsoft Windows Defender ImagePath entry at the time as follows:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MpDefenderCoreService.exe

Since this issue was also related to Nessus, I suspect that the core Nessus vulnerability database hasn't been updated to reflect the extenuating circumstances regarding this detect that I found at that time, and also possibly Microsoft had decided to 'fix' that particular entry in order to avoid the detection and likely significant number of reports from customers like you it may have generated.

I can recall the date only because I found the original thread and my responses originally posted in the legacy Answers forums that Microsoft happened to migrate to these Q&A forums when they were merged last year. Here's the link to the entire thread here, though it's badly misordered due to the fact that the current forums are designed to move more relevant posts and answers to the top, which means that my own posts are the 2nd and 3rd among the 'Answers' provided, since another poster's post tagged as 'Anonymous', which was how those other than regular forum posters like me were migrated, was marked by others as helpful 3 times rather than my own at 2 times each.

Unquoted Service Path Enumeration Issue - Microsoft Q&A

Now the truth is I never saw any official documentation that confirmed what I discovered when I researched my answer post at the time or since, but based on everything I read then, I still believe that post explains fairly well why Microsoft wouldn't have seen this either as a true issue, nor typically bothered to 'fix' these quotation issues, since with the core changes they'd made to both Windows 10 and especially 11 previous to that point in time, this old vulnerability had actually been removed making the use of quotes no longer necessary.

I don't plan on researching this issue again and only see it myself as a clear indication that the Nessus vulnerability database and anyone who chooses to base their own future products on it are badly maintained, which isn't surprising to me since as I recall, the Nessus product was open-source.

The remainder of this post beyond my name below is a copy/paste of my answer post in that previous thread where I tried to explain why the Windows Unquoted Service Path Enumeration vulnerability is no longer an issue with either Windows 10 or especially Windows 11.

Rob

Original post from earlier thread:

Let me try this again after researching this old issue in more detail.

After reading up on the original issue it became clear that this particular vulnerability related specifically to the ability to write a file into the folder found at the path listed up to and including the portion preceding the space, named as the word immediately following the space and preceding the following slash "/" character.

In this particular example, that would be accomplished as follows:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MpDefenderCoreService.exe

C:\ProgramData\Microsoft\Windows[Defender.exe]

Examining this folder within my own much older Windows 10 system, I found it to only allow Read & Execute access to either the EVERYONE or Users groups, while both SYSTEM and Administrators of course have Full Control.

Since the focus of this particular vulnerability is to allow a local user to install a Trojan horse executable which is then used to gain privileges, it appears from what I found that this simply isn't possible, since the target folder itself would be unwritable unless a local user already had the Administrator privileges necessary to write into that specific folder.

However, if the corresponding registry item related to that same detection were able to be written by an unprivileged user, they might modify this path in order to point at another unprotected folder into which they could copy their Trojan executable, creating the same potential issue in reverse.

So from what I see, I'm guessing it's likely that at least with Windows 11, the folders containing critical driver files may have been better secured by default, precluding the ability for less privileged users to copy a Trojan, while along with this, the recent change in Windows 11 23r2 removes the ability for nearly anyone to modify these critical registry path entries as well.

In other words, it's not truly the way that Windows interprets the path that's the issue, but rather the ability to manipulate it and insert rogue files into the corresponding folder, so Microsoft has focused on removing those issues instead, first by securing the respective folders in Windows 10 and now by securing the potential manipulation of the registry entries pointing to their location in Windows 11 23r2.

Note that this is only my speculation, but it fits both what I'm seeing, and you are describing quite well.

I understand the potential issues this creates with auditing until this speculation is confirmed, but that's something I'd dealt with for many years with the relatively rigid structures these people operate within.

Having the same issue.

We are also seeing the same Nessus “unquoted service path” finding for these two Microsoft Defender services:

Sense C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8838.26060.15013-0\MsSense.exe

DefenderUpdateSvc C:\ProgramData\Microsoft\Microsoft Defender\Defender Update\Platform\10.8838.26060.15013-0\DefenderUpdateService.exe

Our findings so far:

• Both paths contain spaces and lack surrounding quotation marks. We confirmed this directly in the current ImagePath values under HKLM\SYSTEM\CurrentControlSet\Services\<service name>.
• Attempts to add quotation marks using sc.exe config return Access is denied.
• Direct edits to the corresponding registry values are also blocked.
• sc.exe qprotection Sense reports WINDOWS LIGHT.
• sc.exe qprotection DefenderUpdateSvc reports ANTIMALWARE LIGHT.
• Registry ACLs grant both Administrators and SYSTEM FullControl on both service keys.
• The owner of the Sense key is SYSTEM; the owner of the DefenderUpdateSvc key is Administrators.
• Tamper Protection is enabled and managed through Intune. However, we have not confirmed whether it specifically causes the blocked ImagePath edits, or whether another Defender self-protection mechanism is responsible.

The official response from Microsoft Support is that the KB released on September 22nd (KB5124010) has remediated this issue.

@Michael Ohff The official response was directly from MS Support

This morning they (MS Support) have informed me that this fix is now available for production. They've said if it doesn't update automatically, you can manually download the update and install it here

Please note that I have not tried and tested this yet to confirm it works. So I'm unsure of the experience after installing, ie, does it add the quotation marks, or allow us to add them. Does it need a restart after the install. However, with it coming from MS Support, it should be reputable information.

However, reading between the lines of the discussion that has been had with the MS Support, this fix will add the quotation marks itself rather than allowing us to add them.

Hope that helps 👍🏻