Bypass Record
Exploitation for Priv-Esc × Quest KACE Agent for Windows
A publicly-reported instance of Exploitation for Priv-Esc bypassing Quest KACE Agent for Windows, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The KSchedulerSvc.exe and AMPTools.exe components have an unquoted service path. A local attacker can place a malicious executable in a parent directory that is parsed before the intended executable, leading to code execution with NT AUTHORITY\SYSTEM privileges when the service starts.
Detection & mitigation
Monitor for unexpected child processes of services with unquoted service paths, especially those spawning from suspicious directories like C:\Program.exe or C:\Program Files\Quest\KACE\AMPTools.exe. Mitigate by ensuring all service paths are quoted and applying vendor patches.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.