SCM Database Handle Failure

Title: SCM Database Handle Failure
Status: test
Description:Detects non-system users failing to get a handle of the SCM database.
References:
  -https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
modified:2022-07-11
Tags:

• -'attack.discovery'
• -'attack.t1010'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4656'
    ObjectType: 'SC_MANAGER OBJECT'
    ObjectName: 'ServicesActive'
    AccessMask: '0xf003f'
  filter:
    SubjectLogonId: '0x3e4'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: medium