Windows Event ID 7036 — Service State Changed
Logged when a service enters a running or stopped state.
Why It Matters
Tracking state changes for security-critical services (Windows Defender, Windows Firewall, Event Log) can reveal tampering. A security service stopping without a corresponding start shortly after is a red flag.
Key Fields
Investigation Tips
- 1.Monitor for Windows Defender (WinDefend) or Firewall (MpsSvc) stopping without a corresponding start.
- 2.Pair with 7034 to distinguish crashes from intentional stops.
Seeing Event ID 7036 in your own logs? Upload an .evtx file — EventPeeker flags service state changed automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Have Event ID 7036 open in Event Viewer?
In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.
Go deeper: the full Windows Defender Disabled or Tampered guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the Windows Defender Disabled or Tampered guide →See Event ID 7036 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects service state changed patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →