Bypass Record
Exploitation for Priv-Esc × ESET Endpoint Antivirus
A publicly-reported instance of Exploitation for Priv-Esc bypassing ESET Endpoint Antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The vulnerability arises from an unquoted service path in ESET products. When the service path contains spaces and is not quoted, Windows may interpret the path ambiguously, allowing an attacker to place a malicious executable in a parent directory that gets executed instead of the intended binary. The attacker must drop a prepared program to a specific location, and it runs on boot with NT AUTHORITY\NetworkService permissions.
Detection & mitigation
Monitor for unexpected child processes of services running with NetworkService or higher privileges, especially from paths with spaces that are not properly quoted. Mitigation: Apply vendor patch and audit service configurations for unquoted service paths using tools like Microsoft's SC or PowerShell to ensure all paths are quoted.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.