Is there any way to create a custom detection to detect when a service is stopped?

Question

I have a service that I'd like to create an alert for if it is stopped, but I can't find any related events to the service stopping in MDE, and as far as I can tell, service status isn't recorded in the registry.

kyrouz · Answer

Excellent question that I have as well. I want to detect when certain services are stopped, no matter the cause (e.g. Powershell, cmd, etc). But none of the MDE tables seem to record service stop events.

itjesusbb · Answer

Kyrouz&nbsp;I ended up talking to MS about this, and the answer is you can't. They said MDE only monitors processes related to Windows.

kyrouz · Answer

Thanks for the update! If anyone at MS is reading: I appreciate that you can't have MDE collect absolutely everything, but service stoppage would be immensely useful in terms of identifying when a critical service is stopped no matter how the attacker got it.

Forum Discussion

Is there any way to create a custom detection to detect when a service is stopped?

3 Replies

Resources