detection.wiki

Microsoft-Windows-Eventlog › Event 1100

Event ID 1100 — The event logging service has shut down.

Provider
Microsoft-Windows-Eventlog
Channel
Security
Level
Informational
Collection Priority
Recommended (JSCU-NL)
Task
Serviceshutdown

Description

The event logging service has shut down.

Message #

The event logging service has shut down.

Fields #

NameDescription
ServiceShutdown—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Eventlog",
    "guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}",
    "event_source_name": "",
    "event_id": 1100,
    "version": 0,
    "level": 4,
    "task": 103,
    "opcode": 0,
    "keywords": 4620693217682128896,
    "time_created": "2023-11-05T22:31:36.994928+00:00",
    "event_record_id": 3371,
    "correlation": {},
    "execution": {
      "process_id": 1816,
      "thread_id": 1352
    },
    "channel": "Security",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "user_data": {
    "ServiceShutdown": {}
  },
  "message": ""
}

Detection Rules #

View all rules referencing this event →

Splunk # view in reference

  • Windows Event Logging Service Has Shutdown source: The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.

References #