<jupyter_start><jupyter_text>Remote Service Control Manager Handle  Metadata |     Metadata      |  Value  ||:------------------|:---|| collaborators     | ['@Cyb3rWard0g', '@Cyb3rPandaH'] || creation date     | 2019/08/26 || modification date | 2020/09/20 || playbook related  | [] |  HypothesisAdversaries might be attempting to open up a handle to the service control manager (SCM) database on remote endpoints to check for local admin access in my environment.  Technical ContextOften times, when an adversary lands on an endpoint, the current user does not have local administrator privileges over the compromised system.While some adversaries consider this situation a dead end, others find it very interesting to identify which machines on the network the current user has administrative access to.One common way to accomplish this is by attempting to open up a handle to the service control manager (SCM) database on remote endpoints in the network with SC_MANAGER_ALL_ACCESS (0xF003F) access rights.The Service Control Manager (SCM) is a remote procedure call (RPC) server, so that service configuration and service control programs can manipulate services on remote machines.Only processes with Administrator privileges are able to open a handle to the SCM database.This database is also known as the ServicesActive database.Therefore, it is very effective to check if the current user has administrative or local admin access to other endpoints in the network.  Offensive TradecraftAn adversary can simply use the Win32 API function [OpenSCManagerA](https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-openscmanagera) to attempt to establish a connection to the service control manager (SCM) on the specified computer and open the service control manager database.If this succeeds (A non-zero handle is returned), the current user context has local administrator acess to the remote host.Additional reading* https://github.com/OTRF/ThreatHunter-Playbook/tree/master/docs/library/windows/service_control_manager.md  Security Datasets | Metadata  |    Value  ||:----------|:----------|| docs      | https://securitydatasets.com/notebooks/atomic/windows/07_discovery/SDWIN-190518224039.html        || link      | [https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_find_localadmin_smb_svcctl_OpenSCManager.zip](https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_find_localadmin_smb_svcctl_OpenSCManager.zip)  |  Analytics  Initialize Analytics Engine<jupyter_code>from openhunt.mordorutils import *
spark = get_spark()<jupyter_output><empty_output><jupyter_text>Download & Process Security Dataset<jupyter_code>sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/discovery/host/empire_find_localadmin_smb_svcctl_OpenSCManager.zip"
registerMordorSQLTable(spark, sd_file, "sdTable")<jupyter_output><empty_output><jupyter_text>Analytic IDetects non-system users failing to get a handle of the SCM database. | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| File | Microsoft-Windows-Security-Auditing | User requested access File | 4656 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SubjectUserName, ProcessName, ObjectName
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 4656
    AND ObjectType = "SC_MANAGER OBJECT"
    AND ObjectName = "ServicesActive"
    AND AccessMask = "0xf003f"
    AND NOT SubjectLogonId = "0x3e4"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IILook for non-system accounts performing privileged operations on protected subsystem objects such as the SCM database | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| File | Microsoft-Windows-Security-Auditing | User requested access File | 4674 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SubjectUserName, ProcessName, ObjectName, PrivilegeList, ObjectServer
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 4674
    AND ObjectType = "SC_MANAGER OBJECT"
    AND ObjectName = "ServicesActive"
    AND PrivilegeList = "SeTakeOwnershipPrivilege"
    AND NOT SubjectLogonId = "0x3e4"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IIILook for inbound network connections to services.exe from other endpoints in the network. Same SourceAddress, but different Hostname | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Security-Auditing | Process connected to Port | 5156 || Process | Microsoft-Windows-Security-Auditing | Process connected to Ip | 5156 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, Application, SourcePort, SourceAddress, DestPort, DestAddress
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 5156
    AND Application LIKE "%\\\services.exe"
    AND LayerRTID = 44
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IVLook for several network connection maded by services.exe from different endpoints to the same destination | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Security-Auditing | Process connected to Port | 3 || Process | Microsoft-Windows-Security-Auditing | Process connected to Ip | 3 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, User, SourcePort, SourceIp, DestinationPort, DestinationIp
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 3
    AND Image LIKE "%\\\services.exe"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic VLook for non-system accounts performing privileged operations on protected subsystem objects such as the SCM database from other endpoints in the network | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Authentication log | Microsoft-Windows-Security-Auditing | User authenticated Host | 4624 || File | Microsoft-Windows-Security-Auditing | User requested access File | 4656 |<jupyter_code>df = spark.sql(
'''
SELECT o.`@timestamp`, o.Hostname, o.SubjectUserName, o.ObjectType,o.ObjectName, o.PrivilegeList, a.IpAddress
FROM sdTable o
INNER JOIN (
    SELECT Hostname,TargetUserName,TargetLogonId,IpAddress
    FROM sdTable
    WHERE LOWER(Channel) = "security"
        AND EventID = 4624
        AND LogonType = 3
        AND NOT TargetUserName LIKE "%$"
    ) a
ON o.SubjectLogonId = a.TargetLogonId
WHERE LOWER(o.Channel) = "security"
    AND o.EventID = 4656
    AND NOT o.SubjectLogonId = "0x3e4"
'''
)
df.show(10,False)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.12673410404624277, 'fraction_numerical': 0.016473988439306357, 'mean_word_length': 4.223396226415094, 'pattern_counts': {'":': 0, '<': 29, '<?xml version=': 0, '>': 29, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '7', 'dir': 'jupyter-structured-clean-dedup', 'id': '281757', 'license': 'MIT', 'n_tokens_mistral': 2034, 'n_tokens_neox': 1882, 'n_words': 603, 'path': 'docs/notebooks/windows/07_discovery/WIN-190826010110.ipynb', 'repo_name': 'hitenkoku/ThreatHunter-Playbook', 'size': '6920'}