Event ID 7040: The start type of a service was changed
Written when a service changes between automatic, manual and disabled.
- Log
- System
- Category
- Defense evasion
Why it matters
- Setting security services (Defender, backup, logging agents) to disabled is a common pre-ransomware step.
What to check
Check which service and the old and new start type.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1562.001 Disable or Modify Tools