A service that only runs a download command
Event 7045 records every new Windows service. Find the one whose binary path is a cmd.exe one-liner, the URL it downloads from, and why the service then failed to start.
Briefing
Lateral movement tools such as PsExec often install a temporary service on the target. You are reviewing the System log of APP-03 after an alert on certutil.
Event 7045 lists the service name, the file it runs, its start type, and the account. Real services point at an executable. A service whose file name is a shell command is a strong signal.
APP-03 · Windows event logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.