topic XQL help to detect when a process is stop or killed and by whom in Cortex XDR Discussions

XQL help to detect when a process is stop or killed and by whom

jrlambea — Thu, 21 Aug 2025 07:55:09 GMT

Hello community,

I'm trying to create a XQL Query to detect whenever a user is stopping a particular service (via services.msc, cmd, powershell, WMI or any other way), but I can not do it.

I need to detect the user that send the stop service command, or the user that is killing the process.

Is it any way to make this query?

This is the closest query that I get:

dataset = xdr_data | filter agent_hostname ="TEST_COMPUTER" and event_sub_type = ENUM.PROCESS_STOP and actor_process_image_name="PanGPS.exe"

But in this query, we only get the user that stopped the process (the service user), but not the user that sent the service stop or process kill command, so we cannot determine whether the service is being stopped regularly (system shutdown) or is being stopped by the user.

Could you help, please?

Thank you very much,
kind regards.

Re: XQL help to detect when a process is stop or killed and by whom

eluis — Fri, 22 Aug 2025 13:04:54 GMT

Hi @jrlambea

Please try with the following and let me know if this works

ataset = xdr_data | filter actor_effective_username != "nt_authority/system" and agent_hostname ="YOUR_HOSTNAME_HERE" and event_sub_type = ENUM.PROCESS_STOP and actor_process_image_name="YOUR_PROCESS_HERE"

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: XQL help to detect when a process is stop or killed and by whom

jrlambea — Fri, 29 Aug 2025 07:38:13 GMT

Hi @eluis!

Thank you very much for your response. The current query doesn't meet our needs because when the process is stopped via the services.msc console, the user that appears in the actor_effective_username field is always nt_authority/system (the user configured for the service).

Could we check if a user opened the service.msc console on the same machine a few minutes beforehand? I'm not sure if this is feasible in XQL, as I'm quite neophyte to it.

Kind regards.