Windows Service Control Manager: Termination of Security-Critical Services With Error
Alerts on error-terminated Windows security and infrastructure services from Service Control Manager event 7023.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows services of interest (including Microsoft Defender, Windows Event Log, firewall components, BitLocker, and related security services) that the Service Control Manager reports as terminated with an error. Attackers may stop or disrupt security services to reduce detection, impair logging, or weaken host protections, making this event important for incident triage. It relies on Windows service telemetry from Service Control Manager Event ID 7023 and matches specific service display names and/or their binary-encoded service name values.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Control Manager: Termination of Security-Critical Services With Error"
id: 14d50868-269c-4a66-9eae-88f2378c33ef
related:
- id: acfa2210-0d71-4eeb-b477-afab494d596c
type: similar
- id: d6b5520d-3934-48b4-928c-2aa3f92d6963
type: derived
status: test
description: This rule flags Windows services of interest (including Microsoft Defender, Windows Event Log, firewall components, BitLocker, and related security services) that the Service Control Manager reports as terminated with an error. Attackers may stop or disrupt security services to reduce detection, impair logging, or weaken host protections, making this event important for incident triage. It relies on Windows service telemetry from Service Control Manager Event ID 7023 and matches specific service display names and/or their binary-encoded service name values.
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
- attack.stealth
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: Service Control Manager
EventID: 7023
selection_name:
- param1|contains:
- " Antivirus"
- " Firewall"
- Application Guard
- BitLocker Drive Encryption Service
- Encrypting File System
- Microsoft Defender
- Threat Protection
- Windows Event Log
- Binary|contains:
- 770069006e0064006500660065006e006400
- 4500760065006e0074004c006f006700
- 6d0070007300730076006300
- "530065006e0073006500"
- "450046005300"
- "420044004500530056004300"
condition: all of selection_*
falsepositives:
- Rare false positives could occur since service termination could happen due to multiple reasons
level: high
license: DRL-1.1