Security Service Stopped

Use case development / Ensure Business Continuity / Detect Service Disruption

sigma

Detection rule

title: Security Service Stopped
status: experimental
description: Detects stopping of security-related services
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7036
    param1|contains:
      - 'Windows Defender'
      - 'MsMpSvc'
      - 'WinDefend'
      - 'Sense'
    param2: 'stopped'
  condition: selection
falsepositives:
  - Legitimate maintenance
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001

Test cases

• Stop Windows Defender service

False positive guidance

Correlate with maintenance windows.

Detection course