Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7000
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-06T00:51:17.873154+00:00'
  event_record_id: 2133
  correlation: {}
  execution:
    process_id: 780
    thread_id: 15664
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  param1: Avira Security
  param2: '%%1053'
  Binary: '41007600690072006100530065006300750072006900740079000000'
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7001
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-04-04T08:05:16.553984+00:00'
  event_record_id: 819
  correlation: {}
  execution:
    process_id: 604
    thread_id: 5640
  channel: System
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  param1: Microsoft Defender Antivirus Network Inspection Service
  param2: Microsoft Defender Antivirus Network Inspection System Driver
  param3: '%%1062'
  Binary: 570064004E00690073005300760063000000
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Fields

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7009
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-06T00:51:17.873154+00:00'
  event_record_id: 2132
  correlation: {}
  execution:
    process_id: 780
    thread_id: 15664
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  param1: '30000'
  param2: Avira Security
  Binary: '41007600690072006100530065006300750072006900740079000000'
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7011
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2016-08-18T15:43:00.939453Z'
  event_record_id: 5503
  correlation: {}
  execution:
    process_id: 476
    thread_id: 200
  channel: System
  computer: IE10Win7
  security:
    user_id: ''
event_data:
  param1: '30000'
  param2: ShellHWDetection

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7022
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-03-04T08:47:55.688837+00:00'
  event_record_id: 154
  correlation: {}
  execution:
    process_id: 596
    thread_id: 2804
  channel: System
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  param1: Network Connection Broker
  Binary: 4E006300620053006500720076006900630065000000
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7023
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-04-07T16:53:23.388188+00:00'
  event_record_id: 1227
  correlation: {}
  execution:
    process_id: 648
    thread_id: 940
  channel: System
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: ''
event_data:
  param1: IsmServ
  param2: '%%58'
  Binary: 490073006D0053006500720076000000
message: ''

Sigma Rules

• Windows Service Terminated With Error
  Detects Windows services that got terminated for whatever reason
• Important Windows Service Terminated With Error
  Detects important or interesting Windows services that got terminated for whatever reason

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7026
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-06T06:25:44.324901+00:00'
  event_record_id: 1704
  correlation: {}
  execution:
    process_id: 780
    thread_id: 784
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  param1: "\r\ndam"
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7030
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-05T23:37:12.953025+00:00'
  event_record_id: 2023
  correlation: {}
  execution:
    process_id: 780
    thread_id: 7872
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  param1: Foxit PDF Reader Update Service
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7034
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-10-25T22:56:14.228587+00:00'
  event_record_id: 1465
  correlation: {}
  execution:
    process_id: 800
    thread_id: 7704
  channel: System
  computer: WinDevEval
  security:
    user_id: ''
event_data:
  param1: OpenSSH SSH Server
  param2: '1'
  Binary: '73007300680064000000'
message: ''

Sigma Rules

• Important Windows Service Terminated Unexpectedly
  Detects important or interesting Windows services that got terminated unexpectedly.

References

• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd349369(v=ws.10)
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7036
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-04-07T17:43:20.414968+00:00'
  event_record_id: 1330
  correlation: {}
  execution:
    process_id: 648
    thread_id: 2116
  channel: System
  computer: WIN-FPV0DSIC9O6.sigma.fr
  security:
    user_id: ''
event_data:
  param1: Portable Device Enumerator Service
  param2: stopped
  Binary: 57005000440042007500730045006E0075006D002F0031000000
message: ''

Sigma Rules

• Windows Defender Threat Detection Service Disabled
  Detects when the "Windows Defender Threat Protection" service is disabled.
• HackTool Service Registration or Execution
  Detects installation or execution of services
• Remote Access Tool Services Have Been Installed - System
  Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

References

• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc756308(v=ws.10)
• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Fields

Fields

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7040
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-06T01:41:08.983907+00:00'
  event_record_id: 2166
  correlation: {}
  execution:
    process_id: 780
    thread_id: 21180
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  param1: OpenSSH Authentication Agent
  param2: disabled
  param3: auto start
  param4: ssh-agent
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc756386(v=ws.10)
• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7042
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-04-04T12:00:04.609673+00:00'
  event_record_id: 1436
  correlation: {}
  execution:
    process_id: 604
    thread_id: 3184
  channel: System
  computer: WIN-TKC15D7KHUR
  security:
    user_id: S-1-5-18
event_data:
  param1: TCP/IP NetBIOS Helper
  param2: stop
  param3: '0x40030011'
  param4: 'Operating System: Network Connectivity (Planned)'
  param5: None
  Binary: 6C006D0068006F007300740073000000
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7043
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2022-04-04T13:06:45.664309+00:00'
  event_record_id: 1473
  correlation:
    ActivityID: CDD19977-4814-0000-6779-D2CD1448D801
  execution:
    process_id: 604
    thread_id: 512
  channel: System
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  param1: Update Orchestrator Service
  Binary: 550073006F005300760063000000
message: ''

References

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Fields

Fields

Example Event

system:
  provider: Service Control Manager
  guid: '{555908d1-a6d7-4695-8e1e-26931d2012f4}'
  event_source_name: Service Control Manager
  event_id: 7045
  version: 0
  level: 4
  task: 0
  opcode: 0
  keywords: 9259400833873739776
  time_created: '2023-11-06T01:01:12.620648+00:00'
  event_record_id: 2150
  correlation: {}
  execution:
    process_id: 780
    thread_id: 21724
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-21-1992711665-1655669231-58201500-1000
event_data:
  ServiceName: TeamViewer
  ImagePath: '"C:\Program Files\TeamViewer\TeamViewer_Service.exe"'
  ServiceType: user mode service
  StartType: auto start
  AccountName: LocalSystem
message: ''

Sigma Rules

• CobaltStrike Service Installations - System
  Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
• smbexec.py Service Installation
  Detects the use of smbexec.py tool by detecting a specific service installation
• Invoke-Obfuscation CLIP+ Launcher - System
  Detects Obfuscated use of Clip.exe to execute PowerShell
• Invoke-Obfuscation STDIN+ Launcher - System
  Detects Obfuscated use of stdin to execute PowerShell
• Invoke-Obfuscation VAR+ Launcher - System
  Detects Obfuscated use of Environment Variables to execute PowerShell

Showing 5 of 39 matching Sigma rules.

References

• Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-unexpected-reboots-system-event-logs
• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Fields

Message

The %1 service was successfully sent a %2 control.

Fields

Message

The %1 service entered the %2 state.

Fields

Message

The start type of the %1 service was changed from %2 to %3.

Fields

Message

The %1 service was successfully sent a %2 control.

 The reason specified was: %3 [%4]

 Comment: %5

Fields

Message

A service was installed in the system.

Service Name:  %1
Service File Name:  %2
Service Type:  %3
Service Start Type:  %4
Service Account:  %5

Fields

Message

A service process other than the one launched by the Service Control Manager connected when starting the %1 service.  The Service Control Manager launched process %2 and process %3 connected instead.

  Note that if this service is configured to start under a debugger, this behavior is expected.

Fields

Message

The following service is taking more than %2 minutes to start and may have stopped responding: %1

Contact your system administrator or service vendor for approximate startup times for this service.

If you think this service might be slowing system response or logon time, talk to your system administrator about whether the service should be disabled until the problem is identified.

You may have to restart the computer in safe mode before you can disable the service.

Fields

Message

The following service has repeatedly stopped responding to service control requests: %1

Contact the service vendor or the system administrator about whether to disable this service until the problem is identified.

You may have to restart the computer in safe mode before you can disable the service.

Fields

Message

The following services failed to start during a run level switch: {Failed Service Names}Please start the services manually and retry the run level switch again or contact the service vendor or administrator.

Message

A run level switch failed. The {Failed Service Name} service did not stop correctly with the following error: {Error}Please stop this service manually and retry the run level switch again or contact the service vendor or administrator.

Fields

Message

The %1 service failed to start due to the following error: 
%2

Fields

Message

The %1 service depends on the %2 service which failed to start because of the following error: 
%3

Fields

Message

The %1 service depends on the %2 group and no member of this group started.

Fields

Message

The %1 service depends on the following service: %2. This service might not be installed.

Fields

Message

The %1 call failed with the following error: 
%2

Fields

Message

The %1 call failed for %2 with the following error: 
%3

Fields

Message

The system reverted to its last known good configuration.  The system is restarting....

Message

No backslash is in the account name. The account name must be in the form: domain\user.

Message

A timeout was reached (%1 milliseconds) while waiting for the %2 service to connect.

Fields

Message

A timeout (%1 milliseconds) was reached while waiting for ReadFile.

Fields

Message

A timeout (%1 milliseconds) was reached while waiting for a transaction response from the %2 service.

Fields

Message

The message returned in the transaction has incorrect size.

Message

Logon attempt with current password failed with the following error: 
%1

Fields

Message

Second logon attempt with old password also failed with the following error: 
%1

Fields

Message

Boot-start or system-start driver ({param1}) must not depend on a service.

Fields

Message

The %1 service has reported an invalid current state %2.

Fields

Message

Detected circular dependencies demand starting %1. Check the service dependency tree.

Fields

Message

Detected circular dependencies auto-starting services. Check the service dependency tree.

Message

The %1 service depends on a service in a group which starts later. Change the order in the service dependency tree to ensure that all services required to start this service are starting before this service is started.

Fields

Message

The %1 service depends on a group which starts later. Change the order in the service dependency tree to ensure that all services required to start this service are starting before this service is started.

Fields

Message

About to revert to the last known good configuration because the %1 service failed to start.

Fields

Message

The %1 service hung on starting.

Fields

Message

The %1 service terminated with the following error: 
%2

Fields

Message

The %1 service terminated with the following service-specific error: 
%2

Fields

Message

At least one service or driver failed during system startup.  Use Event Viewer to examine the event log for details.

Message

The following boot-start or system-start driver(s) did not load: %1

Fields

Message

Windows could not be started as configured. Starting Windows using a previous working configuration.

Message

The %1 Registry key denied access to SYSTEM account programs so the Service Control Manager took ownership of the Registry key.

Fields

Message

Service Control Manager

Message

The %1 service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Fields

Message

The %1 service terminated unexpectedly.  It has done this %2 time(s).  The following corrective action will be taken in %3 milliseconds: %5.

Fields

Message

The Service Control Manager tried to take a corrective action (%2) after the unexpected termination of the %3 service, but this action failed with the following error: 
%4

Fields

Message

The Service Control Manager did not initialize successfully. The security configuration server (scesrv.dll) failed to initialize with error {param1}.  The system is restarting...

Fields

Message

The %1 service terminated unexpectedly.  It has done this %2 time(s).

Fields

Message

The Service Control Manager encountered an error undoing a configuration change to the %1 service.  The service's %2 is currently in an unpredictable state.  If you do not correct this configuration, you may not be able to restart the %1 service or may encounter other errors.  To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Fields

Message

The %1 service was unable to log on as %2 with the currently configured password due to the following error: 
%3

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Fields

Message

The %1 service was unable to log on as %2 with the currently configured password due to the following error: 
Logon failure: the user has not been granted the requested logon type at this computer.
 
Service: %1 
Domain and account: %2
 
This service account does not have the required user right "Log on as a service."
 
User Action
 
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
 
If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

Fields

Message

The %1 service did not shut down properly after receiving a preshutdown control.

Fields