System Event ID 7031 — The service terminated unexpectedly

A service terminated unexpectedly. Failure count and action taken (restart/none) are key.

Why event 7031 matters

Unexplained service crashes of security tools indicate possible tampering, exploitation, or resource-based attacks. Services configured to not restart after failure = attacker disabled them via crash.

How to detect it

Alert: unexpected termination of AV, EDR, SIEM agents, or backup services. Alert: services configured 'take no action' after crash — they won't recover without manual intervention.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Event
| where EventLog == "System" and EventID == 7031   // The service terminated unexpectedly
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:System" EventCode=7031
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The service terminated unexpectedly — add EventData fields: param1, param2, Computer`

Related Service Control Manager events