SCM Database Privileged Operation by Non-System User

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•26

Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.