Windows Event ID 7034 — Service Crashed Unexpectedly
Logged when a Windows service terminates unexpectedly (not by request).
Why It Matters
Repeated service crashes — especially for security services like Windows Defender, Event Log, or the Security Account Manager — can indicate an attacker killing security tooling or a buggy malicious service.
Key Fields
Investigation Tips
- 1.Security-related service crashes (MsMpEng, EventLog, WinDefend) are highest priority — investigate tampering.
- 2.A new service (from 7045) crashing shortly after install may be a poorly written malware persistence mechanism.
- 3.Correlate with 4688 for processes that interacted with the service before the crash.
Seeing Event ID 7034 in your own logs? Upload an .evtx file — EventPeeker flags service crashed unexpectedly automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Go deeper: the full Malicious Service Installation — Persistence via Windows Services guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the Malicious Service Installation — Persistence via Windows Services guide →See Event ID 7034 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects service crashed unexpectedly patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →