During a security assessment, a penetration tester executed the following attack: The tester then shared the results with the security analyst. Which of the following should the analyst do to…

Enabling User Account Control (UAC) helps prevent unauthorized changes to the system but does not directly address the unquoted service path vulnerability, which allows privilege escalation even with UAC enabled.

Enabling a PowerShell execution policy restricts script execution, but the unquoted service path vulnerability exploits how Windows services locate executables, not PowerShell script execution.

The attack refers to the 'unquoted service path' vulnerability, which occurs when a Windows service executable path contains spaces and is not enclosed in quotes, allowing an attacker to inject and execute arbitrary code. Disabling or fixing services with unquoted paths by enclosing the path in quotes directly remediates this specific privilege escalation vulnerability.

Implementing a general security endpoint solution (like EDR) is a good practice for overall security but is a broad measure that may not specifically prevent or remediate the root cause of an unquoted service path vulnerability without specific configuration or detection rules.