Sysmon service terminated unexpectedly (System event , crash count ). Endpoint telemetry is blind until it restarts. · win.system.providerName = Service Control Manager, win.system.eventID = 7031$|^7034

Description

Sysmon service $(win.eventdata.param1) terminated unexpectedly (System event $(win.system.eventID), crash count $(win.eventdata.param2)). Endpoint telemetry is blind until it restarts.

Query · wazuh

View raw source upstream ↗ Wazuh XML

field win.system.providerName="^Service Control Manager$" AND field win.system.eventID="^7031$|^7034$" AND field win.eventdata.param1="^Sysmon"

No license declared

socfortress/Wazuh-Rules publishes no license, and without an express grant the default is all rights reserved. The query above is synthesized from the rule rather than copied out of it, so you can see what the rule matches on; the rule as written stays upstream.

Read the full rule at Windows_Sysmon/sysmon_sensor_health_rules.xml ↗. Why this rule is treated this way.

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

60000 Group of windows rules. anchor level 0

decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
60002 Group of Windows rules for the system channel. anchor level 0

field win.system.channel="^System$"
61102 Windows System error event anchor level 5

field win.system.severityValue="^ERROR$"
200600 Sysmon service terminated unexpectedly (System event , crash count ). Endpoint telemetry is blind until it restarts. · win.system.providerName = Service Control Manager, win.system.eventID = 7031$|^7034 refinement level 12 this rule

field win.system.providerName="^Service Control Manager$" AND field win.system.eventID="^7031$|^7034$" AND field win.eventdata.param1="^Sysmon"

Rule dependencies

Depends on

composes · Wazuh if_sid 61102
- Windows System error event

Detection tier

Atomic IOCs

The whole rule is one thing the adversary controls: a domain, an IP, a file hash. It stops working the moment that value rotates. Collapses the pyramid's bottom three rungs, which structure cannot reliably tell apart. Hidden by default: useful for asking 'has anyone seen this?', misleading as a measure of coverage.
Network & Host Artifacts

A URI shape, a user-agent, a registry path. These are the marks left behind when the adversary's tooling runs. Survives the rotation of any single domain or hash; breaks when the tool is reconfigured.
Tools

Identifies the software rather than the traces of it. Most YARA rules sit here, as do Suricata rules keyed on a hardcoded user-agent. Costs the adversary a rebuild or a new tool.
TTPs

Describes the action rather than anything the adversary owns or used: a process spawning another, a sequence of events, a join across other detections. Survives a tool swap, and the rung worth comparing across sources.
Pending classification

A classifier read the rule and structure alone did not settle it. Every rule in the index has been examined and none is skipped, so these are held for a later pass rather than guessed at. A wrong rung is worse than none. Concentrated in the formats whose rules say least about what they key on.

Metadata

Source: socfortress/Wazuh-Rules
License: No license declared
Severity: High
Status: Unknown
Query type: wazuh
Created: 2026-11-07
Modified: 2026-11-07
Authored by: socfortress
Source ID
Upstream: Windows_Sysmon/sysmon_sensor_health_rules.xml
Type: refinement
Data sources: windows_eventchannel
Platforms: windows

ATT&CK

T1562.001