Windows Service Control Manager: Service Terminated With Error (EventID 7023)

Alerts on Windows services terminated with an error as reported by the Service Control Manager (EventID 7023).

FreeUnreviewedSigmalowv1

windows-service-control-manager-service-terminated-with-error-eventid-7023-acfa2210

title: "Windows Service Control Manager: Service Terminated With Error (EventID 7023)"
id: a8035070-0ec1-4170-b8ab-9818ab13287f
related:
  - id: d6b5520d-3934-48b4-928c-2aa3f92d6963
    type: similar
  - id: acfa2210-0d71-4eeb-b477-afab494d596c
    type: derived
status: test
description: This rule flags Windows service termination events reported by the Service Control Manager, specifically when a service is terminated with an error (EventID 7023). Such terminations can indicate interference with service execution, which may be used by attackers to disrupt local functionality or hide activity. The detection relies on Windows System logs containing Provider_Name set to Service Control Manager and EventID 7023.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
  - attack.stealth
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7023
  condition: selection
falsepositives:
  - False positives could occur since service termination could happen due to multiple reasons
level: low
license: DRL-1.1

What it detects

This rule flags Windows service termination events reported by the Service Control Manager, specifically when a service is terminated with an error (EventID 7023). Such terminations can indicate interference with service execution, which may be used by attackers to disrupt local functionality or hide activity. The detection relies on Windows System logs containing Provider_Name set to Service Control Manager and EventID 7023.

Known false positives

False positives could occur since service termination could happen due to multiple reasons

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.