Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

Windows Service Terminated With Error

Detects Windows services that got terminated for whatever reason

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Fri Apr 14acfa2210-0d71-4eeb-b477-afab494d596cwindows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic1 selector
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7023 # The X Service service terminated with the following error
    condition: selection
False Positives

False positives could occur since service termination could happen due to multiple reasons

References
1
Resolving title…
microsoft.com
MITRE ATT&CK
Related Rules
SimilarDetectionhigh

Important Windows Service Terminated With Error

Detects important or interesting Windows services that got terminated for whatever reason

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
acfa2210-0d71-4eeb-b477-afab494d596c
Status
test
Level
low
Type
Detection
Created
Fri Apr 14
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
Raw Tags
attack.defense-evasion
View on GitHub