Windows Service Terminated With Error (Service Control Manager Event 7023)
Alerts on Windows services terminated with an error as reported by the Service Control Manager (EventID 7023).
FreeReviewedSigma · Low · v2
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-14
- Updated
- 2026-07-31
What it detects
This rule matches Windows System logs where the Service Control Manager reports that an X service terminated with the following error (EventID 7023). Service termination can be an indicator of abnormal execution, persistence attempts, or disruption activity, making these events valuable for correlating with other host and process telemetry. It relies on Windows service infrastructure logging fields for Provider_Name and EventID.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-control-manager-service-terminated-with-error-eventid-7023-acfa2210
title: Windows Service Terminated With Error (Service Control Manager Event 7023)
id: a8035070-0ec1-4170-b8ab-9818ab13287f
related:
- id: d6b5520d-3934-48b4-928c-2aa3f92d6963
type: similar
- id: acfa2210-0d71-4eeb-b477-afab494d596c
type: derived
status: test
description: This rule matches Windows System logs where the Service Control Manager reports that an X service terminated with the following error (EventID 7023). Service termination can be an indicator of abnormal execution, persistence attempts, or disruption activity, making these events valuable for correlating with other host and process telemetry. It relies on Windows service infrastructure logging fields for Provider_Name and EventID.
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
- attack.stealth
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID: 7023
condition: selection
falsepositives:
- False positives could occur since service termination could happen due to multiple reasons
level: low
license: DRL-1.1