CcmExec Service Stop/Start via Event 7036 (Remote CcmPwn Session Hijack)

ills3c Intel&Coffee@Ills3C

•updated 14 days ago•1•0•2

Detects when the System Center Configuration Manager (SCCM / ConfigMgr) client service (CcmExec) is stopped or running based on Windows Event Log System events from the Service Control Manager (EventCode 7036).