windows_critical_service_status.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1089",
  "queries": {
    "Windows_Defender_Services": {
      "query": "SELECT * FROM services WHERE name = 'WinDefend' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Windows Defender service Status change - ATT&CK T1089"
        },
    "Windows_Firewall_Services": {
      "query": "SELECT * FROM services WHERE name = 'MpsSvc' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Windows Firewall service Status change - ATT&CK T1089"
        },
    "Symantec_Endpoint_Protection_Services": {
      "query": "SELECT * FROM services WHERE name = 'SepMasterService' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Symantec Endpoint Protection service Status change - ATT&CK T1089"
        },
            " Sophos_Anti-Virus_Services_1": {
      "query": "SELECT * FROM services WHERE name = 'SAVAdminService' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Symantec Endpoint Protection service Status change - ATT&CK T1089"
        },
            "Sophos_Anti-Virus_Services_2": {
      "query": "SELECT * FROM services WHERE name = 'SavService' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Symantec Endpoint Protection service Status change - ATT&CK T1089"
        },
    "Windows_Security_Service": {
      "query": "SELECT * FROM services WHERE name = 'wscsvc' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Windows Security Service Status change - ATT&CK T1089"
        },
    "Windows_Update_Service": {
      "query": "SELECT * FROM services WHERE name = 'wuauserv' AND status != 'RUNNING';",
      "interval": 3600,
      "description": "Windows Update Service Status change - ATT&CK T1089"
        },
    "Snapshot_services": {
      "query": "SELECT * FROM services;",
      "interval": 28800,
      "description": "Snapshot Services query",
      "snapshot": true
    }
   }
}