Detection rules › Sigma
SCM Database Handle Failure
Detects non-system users failing to get a handle of the SCM database.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4656: A handle to an object was requested. |
Rule body
title: SCM Database Handle Failure
id: 13addce7-47b2-4ca0-a98f-1de964d1d669
status: test
description: Detects non-system users failing to get a handle of the SCM database.
references:
- https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-12
modified: 2022-07-11
tags:
- attack.discovery
- attack.t1010
logsource:
product: windows
service: security
detection:
selection:
EventID: 4656
ObjectType: 'SC_MANAGER OBJECT'
ObjectName: 'ServicesActive'
AccessMask: '0xf003f' # is used in the reference; otherwise too many FPs
# Keywords: 'Audit Failure' <-> in the ref 'Keywords':-9214364837600034816
filter:
SubjectLogonId: '0x3e4'
condition: selection and not filter
falsepositives:
- Unknown
# triggering on many hosts in some environments
level: medium
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
EventID: 4656
ObjectType: 'SC_MANAGER OBJECT'
ObjectName: 'ServicesActive'
AccessMask: '0xf003f'
Stage 2: not filter
filter:
SubjectLogonId: '0x3e4'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
SubjectLogonId | eq | 0x3e4 | excludes:SubjectLogonId field:"SubjectLogonId" value:"0x3e4" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AccessMask | eq |
| field:"AccessMask" kind:eq value:"0xf003f" |
ObjectName | eq |
| field:"ObjectName" kind:eq value:"ServicesActive" |
ObjectType | eq |
| field:"ObjectType" kind:eq value:"SC_MANAGER OBJECT" |