Trusted Path Bypass via Windows Directory Spoofing (0cbe38c0-270c-41d9-ab79-6e5a9a669290)

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Path Interception by PATH Environment Variable - T1574.007 (0c2d00da-7742-49e7-9928-4514e5075d32)	Attack Pattern	Trusted Path Bypass via Windows Directory Spoofing (0cbe38c0-270c-41d9-ab79-6e5a9a669290)	Sigma-Rules	1
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	Trusted Path Bypass via Windows Directory Spoofing (0cbe38c0-270c-41d9-ab79-6e5a9a669290)	Sigma-Rules	1
Path Interception by PATH Environment Variable - T1574.007 (0c2d00da-7742-49e7-9928-4514e5075d32)	Attack Pattern	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	2
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	2