Windows: Unexpected Termination of Message Queuing (MSMQ) Service via SCM Event 7034
Flags Service Control Manager Event ID 7034 for unexpected termination of the Message Queuing (MSMQ) service.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows Service Control Manager events where the Message Queuing (MSMQ) service terminates unexpectedly, as indicated by a Service Control Manager 7034 record. Unexpected service termination can signal persistence disruption, defensive tampering, or exploitation activity targeting key system services. It relies on Windows service telemetry from Event ID 7034 and matching service identifiers in the event fields for Message Queuing.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-control-manager-unexpected-termination-of-message-queuing-msmq-s-56abae0c
title: "Windows: Unexpected Termination of Message Queuing (MSMQ) Service via SCM Event 7034"
id: f18786ea-79db-444d-b9a7-c463b9db94be
status: test
description: This rule flags Windows Service Control Manager events where the Message Queuing (MSMQ) service terminates unexpectedly, as indicated by a Service Control Manager 7034 record. Unexpected service termination can signal persistence disruption, defensive tampering, or exploitation activity targeting key system services. It relies on Windows service telemetry from Event ID 7034 and matching service identifiers in the event fields for Message Queuing.
references:
- https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-14
tags:
- attack.stealth
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: Service Control Manager
EventID: 7034
selection_name:
- param1|contains: Message Queuing
- Binary|contains:
- 4d0053004d005100
- 6d0073006d007100
condition: all of selection_*
falsepositives:
- Rare false positives could occur since service termination could happen due to multiple reasons
level: high
license: DRL-1.1
related:
- id: 56abae0c-6212-4b97-adc0-0b559bb950c3
type: derived