Tools · Windows security and Event Logs · 07 / 27
Event ID 7045 and 4697: detecting new Windows services
Find newly installed services in the System and Security logs, read the image path, and separate software installs from malicious service creation.
Where service installs are logged
Event 7045 in the System log, from the Service Control Manager, says “A service was installed in the system” and includes the service name, image path, service type, start type, and account. It is on by default. Event 4697 in the Security log records the same thing with the subject account, but requires the Security System Extension audit subcategory.
Services run as SYSTEM by default and start automatically, so creating one is a common way for attackers and remote administration tools to run code with high privileges and persist.
Signs of a malicious service
Image paths in user-writable places such as C:\Users, C:\ProgramData, or C:\Windows\Temp. Image paths that run cmd.exe /c or powershell with arguments instead of a service executable. Random-looking service names. Services created and deleted within minutes, which is typical of some remote execution tools.
Legitimate software installs also create services, usually in C:\Program Files with a vendor name and a signed binary. Correlate with software deployment records.
Lab: create a test service and find it
On a lab VM, create a service with sc.exe pointing at a harmless command, then delete it. Query 7045 from the System log for the last hour and print the name, image path, and account. Check the Security log for 4697 if you enabled the subcategory.
Also list current services whose binary path is outside Windows and Program Files, which is the inventory version of the same check.
sc.exe create LabSvc binPath= "cmd.exe /c echo test > C:\Windows\Temp\labsvc.txt" start= demand
sc.exe delete LabSvc
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddHours(-1)} |
% { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }
[pscustomobject]@{Time=$_.TimeCreated; Name=$d.ServiceName; Path=$d.ImagePath; Account=$d.AccountName} }
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"?C:\\(Windows|Program Files)' } | Select Name, PathName, StartNameResponse
Record the image path and hash the binary before stopping the service. Check which account installed it via 4697 or nearby 4624 events, and look for the same service name across your fleet.
Limit who can create services by restricting local administrator rights, the only group that can install services by default.
Diagram
Reading a 7045 image path
The path usually tells you which way to lean.
- C:\Program Files\Vendor\agent.exe
Likely a software install. Confirm with deployment records.
- C:\ProgramData\x\svc.exe
User-writable location. Investigate.
- cmd.exe /c ...
A command, not a service binary. Strong signal of remote execution.
- Random 8-character name, deleted soon after
Typical of some remote execution tools.
Check yourself
1. Which log holds Event 7045?
2. Which 7045 image path is most suspicious?
3. What should you do before stopping a suspicious service?