critical SPL Windows

Security Service Stopped or Disabled

EDR, backup or logging services being stopped. Requires two or more in the same window, which separates pre-encryption housekeeping from ordinary service churn.

Rule source

defensive-service-stopped.spl

# Security Service Stopped or Disabled
# T1489 - Service Stop
# Stopping EDR, backup or logging services is pre-encryption housekeeping.
# Scoped to a named service list so ordinary service churn stays quiet.

index=wineventlog (EventCode=7036 OR EventCode=7040 OR EventCode=1)
| eval svc=coalesce(Service_Name, ServiceName, service_name)
| search svc IN (
      "Sense", "WinDefend", "MsMpSvc", "SecurityHealthService",
      "CrowdStrike Falcon Sensor Service", "SentinelAgent", "cbdefense",
      "VSS", "SQLWriter", "Veeam Backup Service", "EventLog", "Sysmon64")
| eval action=case(
      match(Message, "(?i)stopped"),  "stopped",
      match(Message, "(?i)disabled"), "disabled",
      true(),                          "changed")
| where action != "changed"
| stats
    values(svc)   as services,
    dc(svc)       as service_count,
    values(action) as actions,
    min(_time)    as first_seen,
    max(_time)    as last_seen
  by Computer, user
| where service_count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - service_count

Required telemetry

Windows System - Event ID 7036 and 7040

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Agent upgrades that cycle their own service - correlate with the deployment window
Scheduled backup maintenance stopping VSS writers

Validation

Stopped Sysmon64 and VSS together in the lab, confirmed both reach one alert

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.