Windows Service Installed

Detects a new service being installed (EventID 7045). Service installation is how a great many intrusions both persist and escalate: remote-execution frameworks create a transient service to run a payload as SYSTEM, and remote access tools install a permanent auto-start service to survive reboots. The event is low-volume on servers, which makes it unusually cheap to alert on.

T1543.003 T1569.002

Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `EventID` is 7045.

{
  "detection_type": "selection",
  "selection": {
    "EventID": 7045
  }
}

Log source: product=windows, service=system · Event ID(s): 7045

Required log fields

ServiceName
ImagePath
ServiceType
StartType
AccountName

Enabling this in your environment

Where: Logged to the System event log by the Service Control Manager - no audit policy required, but the System log's default size rotates quickly on busy hosts and should be forwarded.

wevtutil sl System /ms:134217728

ImagePath is the field that matters: a service pointing at a path under %TEMP%, a raw cmd.exe /c, or a named pipe is far more interesting than the service name, which attackers randomise. Alerting on every 7045 is viable on servers but noisy on workstations - scope by ImagePath first.

Seen in incidents

Exposed Service to Domain-Wide Ransomware: 19 Days of Warnings

False positives