Wrong Path

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Read the full path and compare it with the program's home, ignoring case and removing prefixes such as \\?\ and \Device\HarddiskVolume3, because one file can be written several ways.Process Listings and Scans
2. Check the folder itself. Windows or Program Files with an extra space, or a folder of that name inside another path, only looks trusted. Never trim spaces when you normalise a path.Process Listings and Scans
3. Look for a file named like a Windows tool in another program's folder, because a program that starts a tool without its full path can run that copy first.Process Listings and Scans
4. For a service, compare the binary with its ImagePath and its account, and with event 7045 in the System log, which records its install. A service binary in Temp is a finding on its own.Process Listings and Scans
5. Find when the file landed and what wrote it (DeviceFileEvents, Sysmon events 11 and 29), then follow the writer's own chain.Process Trees and Call Chains

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

Some genuine programs live outside System32, such as explorer.exe in C:\Windows, WmiPrvSE.exe in System32\wbem and 32-bit copies in SysWOW64. Compare each with its own home.

A program running as SYSTEM has C:\Windows\Temp as its temporary folder, so installers and updaters can run briefly from there. A known vendor, a valid signature and a short life are the signs of a genuine one.

Blind Spots

A binary that replaced the genuine file in its home folder, or code running inside a genuine process, passes every path check, so pair this with signatures and the injection checks.

Kernel listings print device paths and some tools add \\?\, so a check that compares text without normalising it misses some mismatches and invents others.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// System names away from their home folder, services or SYSTEM processes from writable folders, and look-alike foldersDeviceProcessEvents| where Timestamp > ago(30d)| extend Name = tolower(FileName), Path = tolower(FolderPath)| extend System32 = strcat(@"c:\windows\system32\", Name), SysWow64 = strcat(@"c:\windows\syswow64\", Name)| where (Name in ("smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "services.exe", "lsass.exe", "lsaiso.exe", "spoolsv.exe", "taskhostw.exe", "runtimebroker.exe", "conhost.exe")        and Path != System32)    or (Name in ("svchost.exe", "dllhost.exe") and Path != System32 and Path != SysWow64)    or (Name == "explorer.exe" and Path !in (@"c:\windows\explorer.exe", @"c:\windows\syswow64\explorer.exe"))    or (Name == "wmiprvse.exe" and Path !in (@"c:\windows\system32\wbem\wmiprvse.exe", @"c:\windows\syswow64\wbem\wmiprvse.exe"))    or (Path matches regex @"^c:\\(windows\\temp|programdata|users\\public|users\\[^\\]+\\(downloads|appdata)|\$recycle\.bin)\\"        and (InitiatingProcessFileName =~ "services.exe" or AccountSid == "S-1-5-18")        and not(Path startswith @"c:\programdata\microsoft\windows defender\platform\"))    or Path matches regex @"^c:\\(windows|program files|program files \(x86\)) +\\"| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, AccountName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. The kernel's audit path for each process, a \Device\HarddiskVolume path, beside the PEB's image path.
• windows.malware.pebmasquerade (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. The kernel's name, its audit path and the PEB's path side by side. A wrong folder shows in both paths, while paths that still disagree once normalised point to a rewritten PEB.
• windows.dlllist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. dlllist means DLL list. The first module each process's loader list names is its own image, with the full path.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• ASR: Block use of copied or impersonated system tools (opens in a new tab) Blocks copies of System32 and SysWOW64 tools, or files with their names, when they run from anywhere else.
• App Control for Business (opens in a new tab) An unknown binary in Temp does not run, wherever it was copied, unless a policy trusts it.
• ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion (opens in a new tab) A new, rare file such as a fresh drop in Temp fails the prevalence and age test and is blocked.
• No antivirus exclusions for temporary folders (opens in a new tab) On ws-042 a path exclusion for C:\Windows\Temp, set at 10:04, let updsvc64.exe land there unscanned two minutes later. Check it in the Registry: Microsoft Defender Exclusions

Related

Where It Matters Most

• System A program named System or Registry, or an ntoskrnl.exe outside System32.
• smss.exe Any folder but System32, which some records write as \SystemRoot\System32.
• csrss.exe Any folder but System32, since the short name is easy to borrow.
• wininit.exe Any folder but System32.

See Them in the Tree

On ws-042, 12 Oct 2026

Open it in the tree: updsvc64.exeSuspiciousOpen it in the tree: scvhost.exeSuspicious

In the Clean Tree

Open it in the tree: MsMpEng.exe

Travels with

• Renamed, Unsigned or Falsely Signed Binaries Check the signature and version information of a binary in the wrong folder too, since updsvc64.exe carries neither.
• Misspelt and Look-Alike Names A program in the wrong folder can carry a look-alike name as well, as scvhost.exe in C:\Windows\Temp did.

Check It in the Registry

ShimCache (AppCompatCache)AmcacheBAM (Background Activity Moderator)

Sources

• Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
• Splunk: System Processes Run From Unexpected Locations (opens in a new tab)
• Elastic: Program Files Directory Masquerading (prebuilt rule) (opens in a new tab)
• Microsoft Learn: ASR rule, block use of copied or impersonated system tools (opens in a new tab)
• Microsoft Learn: 4688(S) A new process has been created (opens in a new tab)
• Microsoft Learn: DeviceFileEvents table (opens in a new tab)
• Microsoft Learn: Common mistakes to avoid when defining exclusions (%TEMP% for SYSTEM is C:\Windows\Temp) (opens in a new tab)
• Volatility 3: windows.pstree (opens in a new tab)