Sigma rule: Windows Service Terminated With Error

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-fe633207f356, updated 2023-04-14T00:00:00.000Z.

Rule

Title: Windows Service Terminated With Error
Status: test
Level: low
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-14
File: rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Windows services that got terminated for whatever reason

Log source

product: windows
service: system

Detection

selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7023 # The X Service service terminated with the following error
condition: selection

False positives (as the rule lists them)

False positives could occur since service termination could happen due to multiple reasons

Related rules

d6b5520d-3934-48b4-928c-2aa3f92d6963 (similar)

References

https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml

Sources and licences

SigmaHQ
"Windows Service Terminated With Error" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Windows Service Terminated With Error",
entity page, dataset version ref-fe633207f356, updated 2023-04-14T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/acfa2210-0d71-4eeb-b477-afab494d596c (accessed 2026-11-03).
Underlying source: SigmaHQ rule acfa2210-0d71-4eeb-b477-afab494d596c, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.