Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Important Windows Service Terminated With Error
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
Important Windows Service Terminated With Error
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: Important Windows Service Terminated With Error
id: d6b5520d-3934-48b4-928c-2aa3f92d6963
related:
- id: acfa2210-0d71-4eeb-b477-afab494d596c
type: similar
status: test
description: Detects important or interesting Windows services that got terminated for whatever reason
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-14
tags:
- attack.defense-evasion
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7023 # The X Service service terminated with the following error
selection_name:
- param1|contains:
# Note that these names are "Display Names" and are language specific. If you're using a non-english system these can and will be different
- ' Antivirus'
- ' Firewall'
- 'Application Guard'
- 'BitLocker Drive Encryption Service'
- 'Encrypting File System'
- 'Microsoft Defender'
- 'Threat Protection'
- 'Windows Event Log'
# Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
- Binary|contains:
- '770069006e0064006500660065006e006400' # windefend (Microsoft Defender Antivirus Service)
- '4500760065006e0074004c006f006700' # EventLog
- '6d0070007300730076006300' # mpssvc (Windows Defender Firewall)
- '530065006e0073006500' # Sense (Windows Defender Advanced Threat Protection Service)
- '450046005300' # EFS (Encrypting File System)
- '420044004500530056004300' # BDESVC (BitLocker Drive Encryption Service)
condition: all of selection_*
falsepositives:
- Rare false positives could occur since service termination could happen due to multiple reasons
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml