SCM Database Handle Failure by Non-System User

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.