Unquoted Service Path Enumeration Issue

Are we still on this? I tried to be gracious and wish you well but you're persisting with this.

You are under NO obligation to use the fix I posted. So good luck to you. I don't know why you're taking my fix or "fix" as you put it, so personally.

you said "It's too risky to do what you are doing, but that's on you. I'm not prepared to risk that"

Are you prepared to leave it unquoted until you find a solution that ticks all your boxes?

How much luck have you had finding the perfect solution online? How risky is that?

As I mentioned previously

• I would rather put in a temporary fix to address the NOW issue than leave it vulnerable while I waste even more of my precious time.
• Microsoft may soon issue a permanent fix
• If I have to spend 5 seconds every few months updating the path, then I'll do it.

Please can we put this to bed! Unbelievable!

But it HAS changed!

November
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MpDefenderCoreService.exe

December
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23110.3-0\MpDefenderCoreService.exe

It's too risky to do what you are doing, but that's on you. I'm not prepared to risk that.

I'm now looking at a solution to fire of my remediation script x minutes after logon, that quotes the *existing* value, not a fixed one.

"Secondly, if it did, the vulnerability scanning would detect the new path for MpDefenderCoreService.exe is no longer in quotes, then all that's needed is to slightly adjust the GPO which applies the policy to however many computers on the domain and force a gpupdate"

That is exactly my point! The vuln scanner will not detect the new path because you keep overwriting it with the old quoted path.

Your method is not one I will be using, but I am however trying out a new method as we speak to resolve this. Just waiting for Qualys to check a few laptops, to see if it works.

My method doesn't overwrite with a fixed value, but always quotes whatever value Microsoft deem fit to put there in the first place.

Unfortunately, my method involves using a gpo to push scheduled tasks for logon events to do the fix.

P.S> Results are in. Didn't work.

My script encloses the service path in quotes at user logon...I can see this in my logs, but after this event, Microsoft change it back to unquoted.

Further to this, I think the issue is the service possibly being Automatic (Delayed Start), so therefore it changes it when the service starts, so short of running my script every x minutes....which is ridiculous, this seems unfixable in a nice way.

Noted about posting a reply to each person. I posted once and nothing appeared. Posted a few times more and still nothing. But they eventually appeared, I guess

"You are going to continually overwrite with the wrong exe path when this happens"

Unless someone is being diligent and using various automated tools to continuously monitor and remediate any type of defect. Which we all should be doing anyway. I don't understand how your point would be an issue. Firstly the path rarely changes. Secondly, if it did, the vulnerability scanning would detect the new path for MpDefenderCoreService.exe is no longer in quotes, then all that's needed is to slightly adjust the GPO which applies the policy to however many computers on the domain and force a gpupdate.. Easily done in a few minutes.