#Identify Unquoted paths $vulnSvc = gwmi win32_service | foreach{$_} | where {($_.pathname -ne $null) -and ($_.pathname.trim() -ne "")} | where {-not $_.pathname.startswith("`"")} | where {($_.pathname.substring(0, $_.pathname.indexof(".exe") + 4 )) -match ".* .*" } $vulnSvc | Write-Host #Fix Unquoted path issues $vulnSvc | Write-Host foreach ($unQSvc in $vulnSvc) { $svc = $unQSvc.name $SvcReg = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\$svc if ($SvcReg.imagePath -like "*.exe *") { $SvcRegSp = $SvcReg.imagePath -split ".exe" $SvcRegSp0 = $SvcRegSp[0] $SvcRegSp1 = $SvcRegSp[1] $image = "`"$SvcRegSp0" + ".exe`"" + " " + $SvcRegSp1 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name ImagePath -Value $image } if ($SvcReg.imagePath -like "*.sys *") { $SvcRegSp = $SvcReg.imagePath -split ".sys" $SvcRegSp0 = $SvcRegSp[0] $SvcRegSp1 = $SvcRegSp[1] $image = "`"$SvcRegSp0" + ".sys`"" + " $SvcRegSp1" Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name ImagePath -Value $image } if ($SvcReg.imagePath -like "*.exe") { $image = $SvcReg.ImagePath Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name ImagePath -Value "`"$image`"" } }