huntrule

Windows Security: Non-System SeTakeOwnershipPrivilege granted on SCM database object

Flags non-system users requesting SeTakeOwnershipPrivilege on the SCM database object servicesactive in Windows Security 4674.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Roberto Rodriguez @Cyb3rWard0g, Tim Shelton (SigmaHQ), DRL 1.1
Published
2019-08-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows Security events where a non-system subject requests the SeTakeOwnershipPrivilege on the SCM database object (ObjectType "SC_MANAGER OBJECT" / ObjectName "servicesactive"). Such privileged access can help an attacker manipulate Windows services configuration and support privilege escalation or persistence. The detection relies on Event ID 4674 (privilege use), using the target object and privilege name, and excludes activity originating from a specific system-logon context tied to services.exe.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Malicious macOS Credential Verification via dscl authonly
Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)
Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)
Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Linux setcap sets cap_setuid on a binary via setcap utility
Windows Security: Non-System SeTakeOwnershipPrivilege granted on SCM database object
Pivot detection · T1548 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.