Event ID 7036: A service entered the running or stopped state
Written when a service starts or stops.
- Log
- System
- Category
- Service
Why it matters
- Very noisy, but useful for spotting a security product or the event log service being stopped.
What to check
Filter to the services you care about and check when they stopped.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1562.001 Disable or Modify Tools