Windows Service Control Manager: Important service terminated with error

Alerts on error-terminated Windows security and infrastructure services from Service Control Manager event 7023.

FreeUnreviewedSigmahighv1

windows-service-control-manager-important-service-terminated-with-error-d6b5520d

title: "Windows Service Control Manager: Important service terminated with error"
id: 14d50868-269c-4a66-9eae-88f2378c33ef
related:
  - id: acfa2210-0d71-4eeb-b477-afab494d596c
    type: similar
  - id: d6b5520d-3934-48b4-928c-2aa3f92d6963
    type: derived
status: test
description: This rule flags Windows service terminations reported by the Service Control Manager event when the service matches a set of important security, firewall, encryption, event logging, or platform services and the event indicates the service ended with an error. Attackers may rely on service disruption to weaken defenses or interfere with auditing before further actions. It relies on Windows System telemetry from the Service Control Manager, specifically the event identifier and service name fields that match the configured display-name and binary-encoded service name patterns.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
  - attack.stealth
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7023
  selection_name:
    - param1|contains:
        - " Antivirus"
        - " Firewall"
        - Application Guard
        - BitLocker Drive Encryption Service
        - Encrypting File System
        - Microsoft Defender
        - Threat Protection
        - Windows Event Log
    - Binary|contains:
        - 770069006e0064006500660065006e006400
        - 4500760065006e0074004c006f006700
        - 6d0070007300730076006300
        - "530065006e0073006500"
        - "450046005300"
        - "420044004500530056004300"
  condition: all of selection_*
falsepositives:
  - Rare false positives could occur since service termination could happen due to multiple reasons
level: high
license: DRL-1.1

What it detects

This rule flags Windows service terminations reported by the Service Control Manager event when the service matches a set of important security, firewall, encryption, event logging, or platform services and the event indicates the service ended with an error. Attackers may rely on service disruption to weaken defenses or interfere with auditing before further actions. It relies on Windows System telemetry from the Service Control Manager, specifically the event identifier and service name fields that match the configured display-name and binary-encoded service name patterns.

Known false positives

Rare false positives could occur since service termination could happen due to multiple reasons

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.