sigmahighHunting

Important Windows Service Terminated With Error

Detects important or interesting Windows services that got terminated for whatever reason

Detection Query

selection_eid:
  Provider_Name: Service Control Manager
  EventID: 7023
selection_name:
  - param1|contains:
      - " Antivirus"
      - " Firewall"
      - Application Guard
      - BitLocker Drive Encryption Service
      - Encrypting File System
      - Microsoft Defender
      - Threat Protection
      - Windows Event Log
  - Binary|contains:
      - 770069006e0064006500660065006e006400
      - 4500760065006e0074004c006f006700
      - 6d0070007300730076006300
      - "530065006e0073006500"
      - "450046005300"
      - "420044004500530056004300"
condition: all of selection_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2023-04-14

Data Sources

windowssystem

Platforms

windows

References

https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/

Tags

attack.defense-evasion

Raw Content

title: Important Windows Service Terminated With Error
id: d6b5520d-3934-48b4-928c-2aa3f92d6963
related:
    - id: acfa2210-0d71-4eeb-b477-afab494d596c
      type: similar
status: test
description: Detects important or interesting Windows services that got terminated for whatever reason
references:
    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-14
tags:
    - attack.defense-evasion
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7023 # The X Service service terminated with the following error
    selection_name:
        - param1|contains:
              # Note that these names are "Display Names" and are language specific. If you're using a non-english system these can and will be different
              - ' Antivirus'
              - ' Firewall'
              - 'Application Guard'
              - 'BitLocker Drive Encryption Service'
              - 'Encrypting File System'
              - 'Microsoft Defender'
              - 'Threat Protection'
              - 'Windows Event Log'
        # Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
        - Binary|contains:
              - '770069006e0064006500660065006e006400' # windefend (Microsoft Defender Antivirus Service)
              - '4500760065006e0074004c006f006700' # EventLog
              - '6d0070007300730076006300' # mpssvc (Windows Defender Firewall)
              - '530065006e0073006500' # Sense (Windows Defender Advanced Threat Protection Service)
              - '450046005300' # EFS (Encrypting File System)
              - '420044004500530056004300' # BDESVC (BitLocker Drive Encryption Service)
    condition: all of selection_*
falsepositives:
    - Rare false positives could occur since service termination could happen due to multiple reasons
level: high