Windows Service Control Manager: Unexpected termination of Message Queuing (MSMQ) service

title: "Windows Service Control Manager: Unexpected termination of Message Queuing (MSMQ) service"
id: f18786ea-79db-444d-b9a7-c463b9db94be
status: test
description: This rule identifies Windows services that terminated unexpectedly, specifically when the Service Control Manager reports termination events for Message Queuing (MSMQ). Attackers may target or disrupt important services to impact availability or cover their activity, making unexpected termination a useful indicator. It relies on Windows Service Control Manager telemetry (Event ID 7034) including the service name as a display string (param1) and/or its binary-encoded form.
references:
  - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
  - attack.stealth
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7034
  selection_name:
    - param1|contains: Message Queuing
    - Binary|contains:
        - 4d0053004d005100
        - 6d0073006d007100
  condition: all of selection_*
falsepositives:
  - Rare false positives could occur since service termination could happen due to multiple reasons
level: high
license: DRL-1.1
related:
  - id: 56abae0c-6212-4b97-adc0-0b559bb950c3
    type: derived