Windows Event ID 7045 – Service Control Manager: New Service Installation

Start by examining the specific details of Event ID 7045 to understand what service was installed and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 7045 by right-clicking the System log and selecting Filter Current Log
4. Enter 7045 in the Event IDs field and click OK
5. Double-click on recent Event ID 7045 entries to examine details
6. Review the General tab for service name, executable path, and startup type
7. Check the Details tab for additional structured data including the user SID who installed the service

Use PowerShell to programmatically analyze Event ID 7045 patterns and extract detailed service installation information.

1. Open PowerShell as Administrator
2. Query recent service installations with this command:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -MaxEvents 50 | Select-Object TimeCreated, @{Name='ServiceName';Expression={$_.Properties[0].Value}}, @{Name='ImagePath';Expression={$_.Properties[1].Value}}, @{Name='ServiceType';Expression={$_.Properties[2].Value}}, @{Name='StartType';Expression={$_.Properties[3].Value}} | Format-Table -AutoSize

3. For detailed analysis of a specific timeframe, use:

$StartTime = (Get-Date).AddDays(-7)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$StartTime}
$Events | ForEach-Object {
    [PSCustomObject]@{
        Time = $_.TimeCreated
        ServiceName = $_.Properties[0].Value
        ImagePath = $_.Properties[1].Value
        ServiceType = $_.Properties[2].Value
        StartType = $_.Properties[3].Value
        UserSID = $_.UserId
    }
} | Export-Csv -Path "C:\Temp\ServiceInstallations.csv" -NoTypeInformation

Cross-reference Event ID 7045 with process creation events to understand the installation context and identify the parent process responsible.

1. Enable Process Creation auditing if not already active:

auditpol /set /subcategory:"Process Creation" /success:enable

2. Query Event ID 4688 (Process Creation) around the time of service installation:

$ServiceInstallTime = (Get-Date "2026-03-18 14:30:00")
$TimeWindow = 300 # 5 minutes
$StartTime = $ServiceInstallTime.AddSeconds(-$TimeWindow)
$EndTime = $ServiceInstallTime.AddSeconds($TimeWindow)

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Properties[5].Value -like "*sc.exe*" -or $_.Properties[5].Value -like "*powershell*" -or $_.Properties[5].Value -like "*installutil*"} | Select-Object TimeCreated, @{Name='ProcessName';Expression={$_.Properties[5].Value}}, @{Name='CommandLine';Expression={$_.Properties[8].Value}}

3. Check for service installation via .NET InstallUtil:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Properties[8].Value -like "*InstallUtil*"}

4. Examine the Services registry for additional details:

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" | Where-Object {$_.PSChildName -eq "SuspiciousServiceName"} | Get-ItemProperty

Analyze the service executable file for legitimacy, digital signatures, and potential malicious indicators.

1. Extract the service executable path from Event ID 7045 and verify its digital signature:

$ServicePath = "C:\Path\To\Service.exe"
$Signature = Get-AuthenticodeSignature -FilePath $ServicePath
Write-Host "Signature Status: $($Signature.Status)"
Write-Host "Signer: $($Signature.SignerCertificate.Subject)"
Write-Host "Timestamp: $($Signature.TimeStamperCertificate.NotAfter)"

2. Check file properties and version information:

$FileInfo = Get-ItemProperty -Path $ServicePath
$VersionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($ServicePath)
Write-Host "File Version: $($VersionInfo.FileVersion)"
Write-Host "Product Name: $($VersionInfo.ProductName)"
Write-Host "Company Name: $($VersionInfo.CompanyName)"
Write-Host "File Description: $($VersionInfo.FileDescription)"

3. Calculate file hash for threat intelligence lookup:

$Hash = Get-FileHash -Path $ServicePath -Algorithm SHA256
Write-Host "SHA256 Hash: $($Hash.Hash)"

4. Check if the executable is in a suspicious location:

$SuspiciousPaths = @("%TEMP%", "%APPDATA%", "C:\Users", "C:\ProgramData")
$IsSuspicious = $SuspiciousPaths | Where-Object {$ServicePath -like "*$_*"}
if ($IsSuspicious) {
    Write-Warning "Service executable is in a potentially suspicious location: $ServicePath"
}

Implement advanced correlation techniques to identify sophisticated threats that use service installation as part of a larger attack chain.

1. Create a comprehensive timeline of system events around service installation:

$TargetTime = (Get-Date "2026-03-18 14:30:00")
$TimeWindow = 1800 # 30 minutes
$StartTime = $TargetTime.AddSeconds(-$TimeWindow)
$EndTime = $TargetTime.AddSeconds($TimeWindow)

# Collect multiple event types
$Events = @()
$Events += Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={'ServiceInstall'}}, @{Name='Details';Expression={"Service: $($_.Properties[0].Value), Path: $($_.Properties[1].Value)"}}
$Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={'ProcessCreation'}}, @{Name='Details';Expression={"Process: $($_.Properties[5].Value)"}}
$Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventType';Expression={'Logon'}}, @{Name='Details';Expression={"User: $($_.Properties[5].Value), Type: $($_.Properties[8].Value)"}}

$Events | Sort-Object TimeCreated | Format-Table -AutoSize

2. Analyze service installation patterns for anomalies:

# Check for multiple services installed in short timeframe
$RecentServices = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddHours(-24)}
$ServicesByHour = $RecentServices | Group-Object {$_.TimeCreated.ToString("yyyy-MM-dd HH")} | Where-Object {$_.Count -gt 3}
if ($ServicesByHour) {
    Write-Warning "Unusual service installation activity detected:"
    $ServicesByHour | ForEach-Object {
        Write-Host "$($_.Name): $($_.Count) services installed"
    }
}

3. Check for services with suspicious characteristics:

$SuspiciousServices = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} | Where-Object {
    $ServiceName = $_.Properties[0].Value
    $ImagePath = $_.Properties[1].Value
    
    # Flag services with suspicious names or paths
    ($ServiceName -match "[0-9]{8,}" -or 
     $ServiceName -match "^[a-f0-9]{32}$" -or
     $ImagePath -like "*\temp\*" -or
     $ImagePath -like "*\appdata\*" -or
     $ImageName -like "*.tmp" -or
     $ServiceName.Length -lt 3)
}

if ($SuspiciousServices) {
    Write-Warning "Potentially malicious services detected:"
    $SuspiciousServices | ForEach-Object {
        Write-Host "Time: $($_.TimeCreated), Service: $($_.Properties[0].Value), Path: $($_.Properties[1].Value)"
    }
}

4. Export findings for further analysis:

$Report = @()
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-30)} | ForEach-Object {
    $Report += [PSCustomObject]@{
        Timestamp = $_.TimeCreated
        ServiceName = $_.Properties[0].Value
        ImagePath = $_.Properties[1].Value
        ServiceType = $_.Properties[2].Value
        StartType = $_.Properties[3].Value
        UserSID = $_.UserId
        Suspicious = ($_.Properties[1].Value -like "*\temp\*" -or $_.Properties[1].Value -like "*\appdata\*")
    }
}
$Report | Export-Csv -Path "C:\Temp\ServiceInstallationAnalysis.csv" -NoTypeInformation