Detectionhightest
Important Windows Service Terminated With Error
Detects important or interesting Windows services that got terminated for whatever reason
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Fri Apr 14d6b5520d-3934-48b4-928c-2aa3f92d6963windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7023 # The X Service service terminated with the following error
selection_name:
- param1|contains:
# Note that these names are "Display Names" and are language specific. If you're using a non-english system these can and will be different
- ' Antivirus'
- ' Firewall'
- 'Application Guard'
- 'BitLocker Drive Encryption Service'
- 'Encrypting File System'
- 'Microsoft Defender'
- 'Threat Protection'
- 'Windows Event Log'
# Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
- Binary|contains:
- '770069006e0064006500660065006e006400' # windefend (Microsoft Defender Antivirus Service)
- '4500760065006e0074004c006f006700' # EventLog
- '6d0070007300730076006300' # mpssvc (Windows Defender Firewall)
- '530065006e0073006500' # Sense (Windows Defender Advanced Threat Protection Service)
- '450046005300' # EFS (Encrypting File System)
- '420044004500530056004300' # BDESVC (BitLocker Drive Encryption Service)
condition: all of selection_*False Positives
Rare false positives could occur since service termination could happen due to multiple reasons
References
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
d6b5520d-3934-48b4-928c-2aa3f92d6963
Status
test
Level
high
Type
Detection
Created
Fri Apr 14
Path
rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml
Raw Tags
attack.defense-evasion