Event ID 7045: A service was installed in the system
Written in the System log by the Service Control Manager when a new service is installed. Logged by default.
- Log
- System
- Category
- Persistence
Why it matters
- Because it is on by default, it is often the best record of PsExec, remote admin tools and malware installing services.
- Random-looking service names and paths with cmd, PowerShell or %COMSPEC% are red flags.
What to check
Check Service Name, Image Path, Service Type, Start Type and Account Name.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1543.003 Windows Service
- T1569.002 Service Execution