Suspicious Creation Exe for Service with Unquoted Path (via file_event)

This rule detects threat actors may execute their own hostile payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.