Service exited with a service-specific error code.
Security services terminating with error codes indicate possible tampering or exploitation.
Alert: security tool service errors. Investigate error codes for root cause.
param1param2Computer Starting points — adapt the log source, projected fields and thresholds for your environment.
Event
| where EventLog == "System" and EventID == 7024 // The service terminated with a service-specific error
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:System" EventCode=7024
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The service terminated with a service-specific error — add EventData fields: param1, param2, Computer`The service terminated with a service-specific error. Service exited with a service-specific error code.
Event 7024 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.
Alert: security tool service errors. Investigate error codes for root cause.