Windows Security Event 4656: Non-system handle failure to SCM database object
Alerts on failed SCM database handle requests for ServicesActive from non-system logons using Windows Security Event ID 4656.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
- Published
- 2019-08-12
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Security auditing events where access attempts to the Service Control Manager database object named ServicesActive fail, using the specified AccessMask. Attackers may probe or enumerate SCM-related resources and can trigger handle acquisition failures during discovery or interaction attempts. It relies on Security log EventID 4656 telemetry, filtering specifically for non-system subjects and matching the SCM object type and name.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 4656: Non-system handle failure to SCM database object"
id: 8d683a02-01cc-4954-ad88-58aae48e6ead
status: test
description: This rule identifies Windows Security auditing events where access attempts to the Service Control Manager database object named ServicesActive fail, using the specified AccessMask. Attackers may probe or enumerate SCM-related resources and can trigger handle acquisition failures during discovery or interaction attempts. It relies on Security log EventID 4656 telemetry, filtering specifically for non-system subjects and matching the SCM object type and name.
references:
- https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_scm_database_handle_failure.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-12
modified: 2022-07-11
tags:
- attack.discovery
- attack.t1010
logsource:
product: windows
service: security
detection:
selection:
EventID: 4656
ObjectType: SC_MANAGER OBJECT
ObjectName: ServicesActive
AccessMask: "0xf003f"
filter:
SubjectLogonId: "0x3e4"
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 13addce7-47b2-4ca0-a98f-1de964d1d669
type: derived