Windows Service Terminated With Error

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.