Trusted Path Bypass via Windows Directory Spoofing

Title: Trusted Path Bypass via Windows Directory Spoofing
Status: experimental
Description:Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
References:
  -https://x.com/Wietze/status/1933495426952421843
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-17
modified:None
Tags:

• -'attack.defense-evasion'
• -'attack.privilege-escalation'
• -'attack.t1574.007'
• -'attack.t1548.002'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|contains:
      -':\Windows \System32\'
      -':\Windows \SysWOW64\'

  condition:selection
Falsepositives:
  -Unlikely
Level: high