def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 4656,
            event.deep_get("ObjectType", default="") == "SC_MANAGER OBJECT",
            event.deep_get("ObjectName", default="") == "ServicesActive",
            event.deep_get("AccessMask", default="") == "0xf003f",
            not event.deep_get("SubjectLogonId", default="") == "0x3e4",
        ]
    ):
        return True
    return False
