A service failed to start. Service name and error code are key.
Security tool service failures (AV, EDR, monitoring agents) may indicate tampering or corruption by attackers.
Alert: failure of security tool services (AV engine, EDR agent, audit log service). Correlate with 7036 (service state changes) for context.
param1param2Computer | Tactic | Technique |
|---|---|
| Defense Evasion | Disable or Modify Tools (T1562.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "System" and EventID == 7000 // The service failed to start due to the following error
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:System" EventCode=7000
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The service failed to start due to the following error — add EventData fields: param1, param2, Computer`
The service failed to start due to the following error. A service failed to start. Service name and error code are key.
Event 7000 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.
Event 7000 is associated with: Disable or Modify Tools (T1562.001).
Alert: failure of security tool services (AV engine, EDR agent, audit log service). Correlate with 7036 (service state changes) for context.