Vulnerability: Qualys QID 105484 - Windows Unquoted/Trusted Service Paths Privilege Escalation Security Issue, Source: Windows Defender

Do not manually quote or take ownership of the Sense and DefenderUpdateSvc registry values; for KB5005292 build 10.8838.26060.15013, no Microsoft-supported client-side modification or replacement update is currently documented, so validate whether the paths are actually exploitable and treat the Qualys result as a temporary exception pending Microsoft guidance or a newer sensor release. ^1^

The exact paths and build have been reproduced publicly, including failed modification attempts under SYSTEM. However, that Q&A discussion is not an official Microsoft declaration that the finding is a false positive or a confirmed product vulnerability.

Recommended handling

1. Leave both Defender service registrations unchanged.
   • Do not disable tamper protection, change ownership, grant extra registry permissions, or force an ImagePath update.
   • These unsupported changes can interfere with Defender servicing and create a weaker configuration than the scanner finding itself.
2. Confirm the finding is limited to these two Defender-managed services. Run from an elevated PowerShell session:

      $names = 'Sense','DefenderUpdateSvc'
   
      foreach ($name in $names) {
          $key = "HKLM:\SYSTEM\CurrentControlSet\Services\$name"
          $svc = Get-CimInstance Win32_Service -Filter "Name='$name'"
   
          [pscustomobject]@{
              Service   = $name
              ImagePath = (Get-ItemProperty $key).ImagePath
              StartName = $svc.StartName
              State     = $svc.State
          }
      }
   

   The returned paths should match the versioned Microsoft Defender locations in the question, not a third-party or user-writable location.
3. Check every executable candidate created by a space in each path. The following inventory derives each truncated .exe candidate and reports whether it already exists and the ACL of its parent directory:

      $services = 'Sense','DefenderUpdateSvc'
      foreach ($svc in $services) {
          $p = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$svc").ImagePath.Trim('"')
          $spaces = [regex]::Matches($p, ' ').Index
   
          foreach ($i in $spaces) {
              $candidate = $p.Substring(0, $i) + '.exe'
              [pscustomobject]@{
                  Service   = $svc
                  Candidate = $candidate
                  Exists    = Test-Path -LiteralPath $candidate
                  ParentACL = (Get-Acl (Split-Path $candidate)).Sddl
              }
          }
      }
   

   Review the output for write or modify access granted to ordinary principals such as Users, Authenticated Users, or Everyone. Do not create test executables on production endpoints. Microsoft’s general secure-path guidance recommends quoting paths containing whitespace and emphasizes correct ACL assignment. ^2^ For a controlled validation, use a nonadministrative test account and the folder’s Properties → Security → Advanced → Effective Access tab to check whether that account can create files in each candidate’s parent directory. Read/execute permission alone does not enable placement of a candidate executable.
4. Check service reconfiguration rights separately. Registry-key ACLs and service-object permissions are different controls. Capture the service security descriptors with:

      sc.exe sdshow Sense
      sc.exe sdshow DefenderUpdateSvc
   

   Confirm through your organization’s ACL review tooling that ordinary users cannot change configuration, start type, or service permissions. Do not replace the descriptors with generic sc sdset examples.

Update and exception disposition

KB5005292 is reused for successive Defender for Endpoint sensor packages, so the KB number alone does not identify one permanent build. Microsoft also notes that distribution can lag across channels. ^3^

• Check the current Windows sensor version and installation location:

    Get-ItemProperty `
      'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection' `
      -Name InstallLocation
  

• Compare it with the Microsoft Update Catalog and Defender for Endpoint release notes. ^4^ ^5^
• The available material does not establish a successor Windows 10/11 sensor build that fixes these paths. Therefore, do not claim that updating already remediates QID 105484; install a newer applicable build when Microsoft publishes one, then rescan.
• Do not rely on server documentation stating that its KB5005292 package cannot be uninstalled: that page’s stated applicability is Windows Server 2012 R2 and 2016, not Windows 10/11.

Qualys classifies QID 105484 as having no patch available. ^6^ If ACL and effective-access testing shows that nonadministrators cannot place any candidate executable or reconfigure either service, document those results and use a time-limited Qualys exception if policy permits. Suppression or risk acceptance is not remediation of the unquoted value.

If policy requires vendor confirmation, open a Microsoft support case containing:

• OS editions/builds and affected device count.
• Sensor build 10.8838.26060.15013.
• ImagePath, sc.exe qc, and sc.exe sdshow output.
• Candidate-path and effective-access results.
• Qualys QID evidence and first-detection date.
• A request for a supported fix or formal risk statement.

The historical WinDefend_ImagePath_fix.reg workaround must not be applied: it targets Windows 8/Windows RT and the WinDefend service, not these Windows 10/11 Sense and DefenderUpdateSvc registrations. ^7^

References

1. Unable to Add Quotes to ImagePath for Microsoft Defender Services ...
2. Security Considerations: Microsoft Windows Shell
3. Microsoft Defender for Endpoint update for EDR Sensor
4. Microsoft Update Catalog
5. Microsoft Defender for Endpoint release notes
6. QID:105484 Windows Unquoted/Trusted Service Paths Privilege ... - Qualys
7. Microsoft Security Bulletin MS13-034 - Important