topic Re: Detect when a service is stopped in Windows in Cortex XDR Discussions

Detect when a service is stopped in Windows

VarunPitale — Wed, 19 Mar 2025 12:03:50 GMT

One of the rules I am trying to create is to know when a particular service is stopped in Windows. Couple of things I have tried.

1. Event IDs: Typically Event ID 7036/7040 is generated when a service is stopped. But I cannot get a single result with my query

dataset = xdr_data
| filter action_evtlog_event_id in (7036,7040)

As per https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Data-Collection

7036 and 7040 are not monitored.

2. Looking at host inventory services:

The following query kind of works, but I cannot create a BIOC rule with this.

config case_sensitive = false
| preset = host_inventory_services | filter service_name contains "XXX" | fields endpoint_name, ip_address, path_name, service_name, service_state
| filter service_state != ENUM.SERVICE_RUNNING

What is a good way to do this? Ideally, I am not looking to block this, but just generate a low level alert for the same.

Re: Detect when a service is stopped in Windows

aspatil — Wed, 19 Mar 2025 15:41:10 GMT

Hello @VarunPitale ,

You can use below sample:

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter event_sub_type = ENUM.PROCESS_STOP

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

Re: Detect when a service is stopped in Windows

VarunPitale — Fri, 21 Mar 2025 12:00:02 GMT

Thanks @aspatil

I tried this solution, but it did not work in some scenarios. We tries by going to services.msc and then in the GUI, picking the service and stopping it. This behavior should also show up in alerts

Re: Detect when a service is stopped in Windows

aspatil — Wed, 26 Mar 2025 07:46:48 GMT

The reason your query might not be capturing service stop events from services.msc is that stopping a service via the GUI does not always generate a process stop event. Instead, it often generates a Windows Event Log (Evtlog) event, which might not be covered by the PROCESS_STOP filter.
dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG
| filter action_evtlog_event_id in (7036, 7040)
| fields _time, agent_hostname, action_evtlog_event_id, action_evtlog_message
| sort desc _time

Stopping a service via the command line (e.g., sc stop <service-name> or net stop <service-name>) might generate a process execution event. You can check for these:
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name in ("cmd.exe", "powershell.exe", "sc.exe", "net.exe")
| filter actor_process_command_line contains "stop"
| fields _time, agent_hostname, actor_process_command_line, actor_effective_username
| sort desc _time

Monitor Service State Changes
config case_sensitive = false
| preset = host_inventory_services
//| filter service_name contains "XXX"
| filter service_state != ENUM.SERVICE_RUNNING
| fields endpoint_name, service_name, service_state
| sort desc report_timestamp