Service started or stopped. ServiceName and State (running/stopped) are key. Very high signal-to-noise when filtered to security-relevant services.
Attackers stop security services before major attack phases: AV stopped before deploying ransomware, EDR agent stopped before credential dumping. Also captures: PsExec service appearing and stopping (lateral movement pattern), attacker-created service lifecycle.
Alert: State=Stopped for AV, EDR, backup, or monitoring services. Alert: unknown service names entering 'running' state (attacker-created services). Alert: rapid service start-stop cycles (service used briefly then cleaned up = attack tool pattern). Build a baseline of expected service names.
param1param2 | Tactic | Technique |
|---|---|
| Defense Evasion | Disable or Modify Tools (T1562.001) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Security Service Stopped
status: stable
description: Critical security service stopped unexpectedly
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: system
detection:
selection:
EventID: 7036
param2: 'stopped'
param1|contains:
- 'Windows Defender'
- 'Windows Security'
- 'CrowdStrike'
- 'Sysmon'
- 'EventLog'
condition: selection
falsepositives:
- Planned maintenance
- Software updates
level: high
tags:
- attack.defense_evasion
- attack.t1562.001
Event
| where EventLog == "System" and EventID == 7036 // The service entered the stopped/running state
// EventData holds: param1, param2
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:System" EventCode=7036
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The service entered the stopped/running state — add EventData fields: param1, param2`
The service entered the stopped/running state. Service started or stopped. ServiceName and State (running/stopped) are key. Very high signal-to-noise when filtered to security-relevant services.
Event 7036 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.
Event 7036 is associated with: Disable or Modify Tools (T1562.001).
Alert: State=Stopped for AV, EDR, backup, or monitoring services. Alert: unknown service names entering 'running' state (attacker-created services). Alert: rapid service start-stop cycles (service used briefly then cleaned up = attack tool pattern). Build a baseline of expected service names.