Windows: Non-system access uses SeTakeOwnershipPrivilege on SCM database object

title: "Windows: Non-system access uses SeTakeOwnershipPrivilege on SCM database object"
id: 3c59c0b6-73f2-4d4b-b8a1-f144765ac568
status: test
description: This rule identifies Windows Security event 4674 where a non-system subject requests the SeTakeOwnershipPrivilege on a specific SCM database object (SC_MANAGER OBJECT named servicesactive). Attackers may attempt to manipulate Service Control Manager related state to gain higher control or set up further privilege escalation. It relies on telemetry from Windows Security logs capturing handle requests, including ObjectType/ObjectName and PrivilegeList, plus ProcessName and SubjectLogonId for exclusion.
references:
  - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_scm_database_privileged_operation.yml
author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton, Huntrule Team
date: 2019-08-15
modified: 2022-09-18
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4674
    ObjectType: SC_MANAGER OBJECT
    ObjectName: servicesactive
    PrivilegeList: SeTakeOwnershipPrivilege
  filter:
    SubjectLogonId: "0x3e4"
    ProcessName|endswith: :\Windows\System32\services.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dae8171c-5ec6-4396-b210-8466585b53e9
    type: derived