Detect when a service is stopped in Windows

[VarunPitale]

One of the rules I am trying to create is to know when a particular service is stopped in Windows. Couple of things I have tried. 

1. Event IDs: Typically Event ID 7036/7040 is generated when a service is stopped. But I cannot get a single result with my query

dataset = xdr_data
| filter action_evtlog_event_id in (7036,7040) 

As per https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Da...

7036 and 7040 are not monitored. 

2. Looking at host inventory services: 

The following query kind of works, but I cannot create a BIOC rule with this.

config case_sensitive = false
| preset = host_inventory_services | filter service_name contains "XXX" | fields endpoint_name, ip_address, path_name, service_name, service_state
| filter service_state != ENUM.SERVICE_RUNNING

What is a good way to do this?  Ideally, I am not looking to block this, but just generate a low level alert for the same.

[aspatil]

Hello @VarunPitale ,

You can use below sample:

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter event_sub_type = ENUM.PROCESS_STOP

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[VarunPitale]

Thanks @aspatil 

I tried this solution, but it did not work in some scenarios. We tries by going to services.msc and then in the GUI, picking the service and stopping it. This behavior should also show up in alerts

[aspatil]

The reason your query might not be capturing service stop events from services.msc is that stopping a service via the GUI does not always generate a process stop event. Instead, it often generates a Windows Event Log (Evtlog) event, which might not be covered by the PROCESS_STOP filter.
dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG
| filter action_evtlog_event_id in (7036, 7040)
| fields _time, agent_hostname, action_evtlog_event_id, action_evtlog_message
| sort desc _time

Stopping a service via the command line (e.g., sc stop <service-name> or net stop <service-name>) might generate a process execution event. You can check for these:
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter actor_process_image_name in ("cmd.exe", "powershell.exe", "sc.exe", "net.exe")
| filter actor_process_command_line contains "stop"
| fields _time, agent_hostname, actor_process_command_line, actor_effective_username
| sort desc _time

Monitor Service State Changes
config case_sensitive = false
| preset = host_inventory_services
//| filter service_name contains "XXX"
| filter service_state != ENUM.SERVICE_RUNNING
| fields endpoint_name, service_name, service_state
| sort desc report_timestamp