Windows Event ID 7040 – Service Control Manager: Service Start Type Changed

Start by examining the specific details of Event ID 7040 to understand what service was changed and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 7040 in the Event IDs field and click OK
5. Double-click on recent Event ID 7040 entries to view details
6. In the event details, note the service name, old start type, new start type, and the user account
7. Check the Details tab for additional information including process ID and security identifier

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7040} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate who made the service changes and correlate with other security events to determine if the changes were authorized.

1. From the Event ID 7040 details, note the User field showing who made the change
2. Navigate to Windows Logs → Security in Event Viewer
3. Filter for Event ID 4656 (handle to object was requested) around the same time
4. Look for corresponding logon events (Event IDs 4624, 4625) for the user account
5. Check if the changes occurred during normal business hours or maintenance windows

Use PowerShell to correlate events by time and user:

# Get service changes from the last 24 hours
$ServiceChanges = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7040; StartTime=(Get-Date).AddDays(-1)}

# Extract user information from each event
$ServiceChanges | ForEach-Object {
    $Event = [xml]$_.ToXml()
    $ServiceName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'param1'} | Select-Object -ExpandProperty '#text'
    $User = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'param5'} | Select-Object -ExpandProperty '#text'
    [PSCustomObject]@{
        Time = $_.TimeCreated
        Service = $ServiceName
        User = $User
        Message = $_.Message
    }
}

Confirm the current state of services that were modified and ensure they align with organizational security policies.

1. Open Services by pressing Win + R, typing services.msc, and pressing Enter
2. Locate the service mentioned in the Event ID 7040 log entry
3. Right-click the service and select Properties
4. Check the current Startup type setting on the General tab
5. Verify if the current setting matches your organization's security baseline
6. Document any services that are not configured according to policy

Use PowerShell to audit all service start types:

# Get all services and their start types
Get-Service | Select-Object Name, Status, StartType | Sort-Object Name

# Check specific security-related services
$SecurityServices = @('Windefend', 'MpsSvc', 'Eventlog', 'Audiosrv')
Get-Service $SecurityServices | Select-Object Name, Status, StartType, DisplayName

Compare against your security baseline using registry values:

# Check service start type in registry
$ServiceName = 'YourServiceName'
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$ServiceName"
Get-ItemProperty -Path $RegPath -Name Start -ErrorAction SilentlyContinue

Set up proactive monitoring to detect unauthorized service changes in real-time and create alerts for critical services.

1. Open Task Scheduler by pressing Win + R, typing taskschd.msc, and pressing Enter
2. Click Create Task in the Actions pane
3. Name the task "Service Change Monitor" and set it to run with highest privileges
4. On the Triggers tab, click New and select On an event
5. Set Log to System, Source to Service Control Manager, and Event ID to 7040
6. On the Actions tab, create a PowerShell script action to send alerts

Create a PowerShell monitoring script:

# Service change monitoring script
$CriticalServices = @('Windefend', 'MpsSvc', 'Eventlog', 'WinRM', 'BITS')

# Register for Event ID 7040
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='System' AND EventCode=7040" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    $Message = $Event.Message
    
    # Check if critical service was modified
    foreach ($Service in $CriticalServices) {
        if ($Message -like "*$Service*") {
            # Send alert (email, SIEM, etc.)
            Write-EventLog -LogName Application -Source "ServiceMonitor" -EventId 1001 -EntryType Warning -Message "Critical service $Service was modified: $Message"
        }
    }
}

Configure Windows Event Forwarding for centralized monitoring:

# Enable WinRM for event forwarding
Enable-PSRemoting -Force
winrm quickconfig -force

# Create custom event forwarding subscription
wecutil cs ServiceChangeSubscription.xml

Perform detailed forensic analysis when unauthorized service changes are detected and implement remediation procedures.

1. Export relevant events for forensic analysis using Event Viewer
2. Navigate to Windows Logs → System
3. Right-click and select Save All Events As
4. Save as EVTX format for detailed analysis
5. Use additional tools to correlate with other security events

Advanced PowerShell forensic analysis:

# Comprehensive service change analysis
$StartTime = (Get-Date).AddDays(-7)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7040; StartTime=$StartTime}

# Parse and analyze events
$Analysis = $Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    $Data = $EventXML.Event.EventData.Data
    
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ServiceName = ($Data | Where-Object {$_.Name -eq 'param1'}).'#text'
        OldStartType = ($Data | Where-Object {$_.Name -eq 'param2'}).'#text'
        NewStartType = ($Data | Where-Object {$_.Name -eq 'param3'}).'#text'
        ProcessName = ($Data | Where-Object {$_.Name -eq 'param4'}).'#text'
        UserAccount = ($Data | Where-Object {$_.Name -eq 'param5'}).'#text'
        ProcessId = $_.ProcessId
        ThreadId = $_.ThreadId
    }
}

# Group by user to identify patterns
$Analysis | Group-Object UserAccount | Sort-Object Count -Descending

Remediate unauthorized changes:

# Restore service to secure configuration
$ServiceName = "YourCompromisedService"
Set-Service -Name $ServiceName -StartupType Automatic
Start-Service -Name $ServiceName

# Verify the change
Get-Service $ServiceName | Select-Object Name, Status, StartType