SCM Database Privileged Operation

Title: SCM Database Privileged Operation
Status: test
Description:Detects non-system users performing privileged operation os the SCM database
References:
  -https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Date: 2019-08-15
modified:2022-09-18
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4674'
    ObjectType: 'SC_MANAGER OBJECT'
    ObjectName: 'servicesactive'
    PrivilegeList: 'SeTakeOwnershipPrivilege'
  filter:
    SubjectLogonId: '0x3e4'
    ProcessName|endswith: ':\Windows\System32\services.exe'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: medium