Windows Security: SCM database handle acquisition failures (Event ID 4656)

title: "Windows Security: SCM database handle acquisition failures (Event ID 4656)"
id: 8d683a02-01cc-4954-ad88-58aae48e6ead
status: test
description: This rule flags Windows Security events where a non-system subject attempts to access the Service Control Manager database object named ServicesActive and fails to get a handle. Failed handle acquisition to SCM-related objects can indicate probing, misconfiguration, or access attempts that do not succeed. The detection relies on Security auditing event ID 4656 with ObjectType set to SC_MANAGER OBJECT, matching the ServicesActive object name, and an AccessMask value of 0xf003f, while excluding a specific SubjectLogonId value.
references:
  - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_scm_database_handle_failure.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-12
modified: 2022-07-11
tags:
  - attack.discovery
  - attack.t1010
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4656
    ObjectType: SC_MANAGER OBJECT
    ObjectName: ServicesActive
    AccessMask: "0xf003f"
  filter:
    SubjectLogonId: "0x3e4"
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 13addce7-47b2-4ca0-a98f-1de964d1d669
    type: derived