Unable to Add Quotes to ImagePath for Microsoft Defender Services (Sense and DefenderUpdateSvc) - Unquoted Service Path Vulnerability

Rahul Borse 30

Hello Team,

We are addressing a vulnerability reported by Tenable Nessus:

Plugin ID: 63155 Plugin Name: Microsoft Windows Unquoted Service Path Enumeration

The scan identifies the following Microsoft Defender services as having unquoted service paths:

Sense

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8838.26060.15013-0\MsSense.exe

DefenderUpdateSvc

C:\ProgramData\Microsoft\Microsoft Defender\Defender Update\Platform\10.8838.26060.15013-0\DefenderUpdateService.exe

The registry values are:

reg query HKLM\SYSTEM\CurrentControlSet\Services\Sense /v ImagePath

ImagePath REG_EXPAND_SZ

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8838.26060.15013-0\MsSense.exe

reg query HKLM\SYSTEM\CurrentControlSet\Services\DefenderUpdateSvc /v ImagePath

ImagePath REG_EXPAND_SZ

C:\ProgramData\Microsoft\Microsoft Defender\Defender Update\Platform\10.8838.26060.15013-0\DefenderUpdateService.exe

When attempting to manually add quotes to the ImagePath value, we receive the following error:

Cannot edit ImagePath: Error writing the value's new contents.

The registry keys appear to be protected and cannot be modified even with local administrator privileges.

Questions

Is this a known issue with Microsoft Defender platform services (Sense and DefenderUpdateSvc)?
Are these service paths intentionally managed by Microsoft and protected by TrustedInstaller?
Is there a Microsoft-supported method to remediate this finding?
Should this vulnerability be considered a false positive or accepted risk when reported by vulnerability scanners such as Nessus?
Are there any Defender platform updates that address this issue by quoting the service paths automatically?

Environment

Microsoft Defender for Endpoint
Windows 10/11 (affected devices)
Vulnerability Scanner: Tenable Nessus Plugin 63155

Dave Smith 5 Reputation points

2026-09-22T13:52:26+00:00

We are observing the same behaviour across multiple affected Windows endpoints. Validation confirmed that the DefenderUpdateSvc and Sense service ImagePath values are currently stored without quotes and match the service configuration returned by sc.exe qc. Multiple remediation attempts were performed using NT AUTHORITY\SYSTEM context, however modification attempts consistently failed with UnauthorizedAccessException. Microsoft Defender Tamper Protection was confirmed enabled on affected devices. The behaviour has been reproduced across multiple systems and appears associated with Microsoft Defender for Endpoint version 10.8838.26060.15013. At present no Microsoft-supported remediation has been identified for modifying these Defender-managed service registrations, therefore we are monitoring future Microsoft Defender platform updates before considering any unsupported workaround

6 answers

Andreas Thodenius 0 Reputation points

2026-09-23T05:44:51.21+00:00
We are also seeing the same Nessus “unquoted service path” finding for these two Microsoft Defender services:

Sense C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8838.26060.15013-0\MsSense.exe

DefenderUpdateSvc C:\ProgramData\Microsoft\Microsoft Defender\Defender Update\Platform\10.8838.26060.15013-0\DefenderUpdateService.exe

Our findings so far:
- Both paths contain spaces and lack surrounding quotation marks. We confirmed this directly in the current ImagePath values under HKLM\SYSTEM\CurrentControlSet\Services\<service name>.
- Attempts to add quotation marks using sc.exe config return Access is denied.
- Direct edits to the corresponding registry values are also blocked.
- sc.exe qprotection Sense reports WINDOWS LIGHT.
- sc.exe qprotection DefenderUpdateSvc reports ANTIMALWARE LIGHT.
- Registry ACLs grant both Administrators and SYSTEM FullControl on both service keys.
- The owner of the Sense key is SYSTEM; the owner of the DefenderUpdateSvc key is Administrators.
- Tamper Protection is enabled and managed through Intune. However, we have not confirmed whether it specifically causes the blocked ImagePath edits, or whether another Defender self-protection mechanism is responsible.
Was this answer helpful?

2 people found this answer helpful.
Test Account0973480234082374 5 Reputation points

2026-09-23T09:47:29.7066667+00:00

Hello,

I’ve taken a look an initial look myself (but am quite early into my review so this is more supplemental), and have some additional information to add. Before I dig into that though, has anyone raised a support ticket with Microsoft yet regarding this?

Regarding Sense, it seems that the location has changed since version 10.8837, where previously it was pointing to "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" rather than ProgramData.

I’m 99% sure that this was already in quotation marks rather than this being put in quotation marks myself, as this is within quotation marks on my non-corporate device and it’s not something I’d have reviewed.

Regarding DefenderUpdateSvc, I cannot see this service, nor any reference of DefenderUpdateService.exe on version 10.8837.

So it seems as though, historically Microsoft followed best practice and put this in quotation marks, however, as part of moving to 10.8838, they’ve moved the location on the c:\ for Sense and haven’t (or have forgotten to) add quotation marks to this service.

I’m going to be logging a ticket with Microsoft Defender support. If anyone has their own case open with them and is happy to share it, I’ll note that in my ticket so they can tie the two cases together.

Michael Ohff 15 Reputation points

2026-09-28T14:21:55.1933333+00:00

Protection level (from the Live Response registry command)

HKLM\SYSTEM\CurrentControlSet\Services\DefenderUpdateSvc → LaunchProtected = 3 (ANTIMALWARE LIGHT)

HKLM\SYSTEM\CurrentControlSet\Services\Sense → LaunchProtected = 2 (WINDOWS LIGHT)

Indeed i can confirm that, but find no official response of Microsoft nor a way to update, the remediation options are just rubbish :) "add double quotation" nothing else
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Unable to Add Quotes to ImagePath for Microsoft Defender Services (Sense and DefenderUpdateSvc) - Unquoted Service Path Vulnerability

Questions

Environment

6 answers

Your answer