Detect when a service is stopped in Windows

[VarunPitale]

One of the rules I am trying to create is to know when a particular service is stopped in Windows. Couple of things I have tried. 

1. Event IDs: Typically Event ID 7036/7040 is generated when a service is stopped. But I cannot get a single result with my query

dataset = xdr_data
| filter action_evtlog_event_id in (7036,7040) 

As per https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

7036 and 7040 are not monitored. 

2. Looking at host inventory services: 

The following query kind of works, but I cannot create a BIOC rule with this.

config case_sensitive = false
| preset = host_inventory_services | filter service_name contains "XXX" | fields endpoint_name, ip_address, path_name, service_name, service_state
| filter service_state != ENUM.SERVICE_RUNNING

What is a good way to do this?  Ideally, I am not looking to block this, but just generate a low level alert for the same.

[aspatil]

Hello @VarunPitale ,

You can use below sample:

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter event_sub_type = ENUM.PROCESS_STOP

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[VarunPitale]

Thanks @aspatil 

I tried this solution, but it did not work in some scenarios. We tries by going to services.msc and then in the GUI, picking the service and stopping it. This behavior should also show up in alerts