Detection rules › Splunk
Windows Event Logging Service Has Shutdown
The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1070.001 Indicator Removal: Clear Windows Event Logs |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Eventlog | 1100 | The event logging service has shut down. |
Stages and Predicates
Stage 1: search
search EventCode=1100
Stage 2: stats
stats BY action, app, change_type, dest, dvc, name, object_attrs, object_category, service, service_name, signature, signature_id, status, subject, vendor_product
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|