Sigma rule: Important Windows Service Terminated With Error

Rule

Title

Important Windows Service Terminated With Error

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-04-14

File

rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects important or interesting Windows services that got terminated for whatever reason

Log source

product

windows

service

system

Detection

selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID: 7023 # The X Service service terminated with the following error
selection_name:
    - param1|contains:
          # Note that these names are "Display Names" and are language specific. If you're using a non-english system these can and will be different
          - ' Antivirus'
          - ' Firewall'
          - 'Application Guard'
          - 'BitLocker Drive Encryption Service'
          - 'Encrypting File System'
          - 'Microsoft Defender'
          - 'Threat Protection'
          - 'Windows Event Log'
    # Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
    - Binary|contains:
          - '770069006e0064006500660065006e006400' # windefend (Microsoft Defender Antivirus Service)
          - '4500760065006e0074004c006f006700' # EventLog
          - '6d0070007300730076006300' # mpssvc (Windows Defender Firewall)
          - '530065006e0073006500' # Sense (Windows Defender Advanced Threat Protection Service)
          - '450046005300' # EFS (Encrypting File System)
          - '420044004500530056004300' # BDESVC (BitLocker Drive Encryption Service)
condition: all of selection_*

False positives (as the rule lists them)

• Rare false positives could occur since service termination could happen due to multiple reasons

Tags

• attack.stealth

Related rules

• acfa2210-0d71-4eeb-b477-afab494d596c (similar)

References

• https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml