😈 [ spencer @techspence ]

A quick and easy way to find services with unquoted service paths is to open up PowerShell and run the following:

Get-WmiObject win32_service | select Name,PathName,StartMode,StartName | where {$_.StartMode -ne "Disabled" -and $_.StartName -eq "LocalSystem" -and $_.PathName

🐥 [ tweet ]