Make sure you have process auditing enabled if you want to look for these events - it's off by default in the windows security policy.
There's also a builtin rule about monitoring for critical server processes, which uses a list you can add to as well. (Another common one would be to look for a process OTHER than a known list to start, which could tell you when something weird is going on.)
I have had customers use the ProcessStop to detect when a service crashes but doesn't stop... someone had some pretty nasty Exchange problems a while back that this helped spot (they saw the mailbox store process crash and used active response to restart the service).