SCM Database Privileged Operation

Status: test
Severity: medium
Log source: product windows, service security
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Source: github.com/SigmaHQ/sigma

Detects non-system users performing privileged operation os the SCM database

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4674: An operation was attempted on a privileged object.

Rule body

title: SCM Database Privileged Operation
id: dae8171c-5ec6-4396-b210-8466585b53e9
status: test
description: Detects non-system users performing privileged operation os the SCM database
references:
    - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
date: 2019-08-15
modified: 2022-09-18
tags:
    - attack.privilege-escalation
    - attack.t1548
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4674
        ObjectType: 'SC_MANAGER OBJECT'
        ObjectName: 'servicesactive'
        PrivilegeList: 'SeTakeOwnershipPrivilege'
    filter:
        SubjectLogonId: '0x3e4'
        ProcessName|endswith: ':\Windows\System32\services.exe'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    EventID: 4674
    ObjectType: 'SC_MANAGER OBJECT'
    ObjectName: 'servicesactive'
    PrivilegeList: 'SeTakeOwnershipPrivilege'

Stage 2: `not filter`

filter:
    SubjectLogonId: '0x3e4'
    ProcessName|endswith: ':\Windows\System32\services.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ProcessName`	ends_with	`:\Windows\System32\services.exe`	`excludes:ProcessName` `field:"ProcessName" value:":\Windows\System32\services.exe"`
`SubjectLogonId`	eq	`0x3e4`	`excludes:SubjectLogonId` `field:"SubjectLogonId" value:"0x3e4"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	eq	`servicesactive` corpus 2 (sigma 2)	`field:"ObjectName" kind:eq value:"servicesactive"`
`ObjectType`	eq	`SC_MANAGER OBJECT` corpus 2 (sigma 2)	`field:"ObjectType" kind:eq value:"SC_MANAGER OBJECT"`
`PrivilegeList`	eq	`SeTakeOwnershipPrivilege`	`field:"PrivilegeList" kind:eq value:"SeTakeOwnershipPrivilege"`

SCM Database Privileged Operation

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`