'Microsoft Windows Unquoted Service Path Enumeration' Vulnerabilities seen for Driver Paths

Products

• Endpoint Security Complete

Issue/Introduction

• When using vulnerability scanners vulnerabilities are seen for 'Microsoft Windows Unquoted Service Path Enumeration' as the path is not in quotes
• Some Agent registry paths may have no quotes but may look like

  \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS

Environment

• Symantec Endpoint Security Windows Agent: Any Supported Version
• Microsoft Windows OS: Windows 10 and Higher

Cause

This happens because the scanner is looking for quotes in the ImagePath value and there are none.

Resolution

This may be a false positive for drivers that are loaded into the kernel at boot. Three examples seen in the path. 

1. \??\ at the beginning instead of quotes means it's loaded into the kernel where it takes the rest of the path literally
2. .SYS at the end of the path is a sign that this is a system driver not a service .exe
3. Registry keys here have a type value which separates drivers vs Win32 processes