Hayabusa medium test sigma

SCM Database Privileged Operation

Detects non-system users performing privileged operation os the SCM database

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 4674,
    "ObjectType": "SC_MANAGER OBJECT",
    "ObjectName": "servicesactive",
    "PrivilegeList": "SeTakeOwnershipPrivilege"
  },
  "filter": {
    "SubjectLogonId": "0x3e4",
    "ProcessName
| endswith": ":\\Windows\\System32\\services.exe"
  },
  "condition": "security and (selection and not filter)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...