What to inspect
- Service name.
- Image path.
- Start type.
- Service account.
- Creation time.
- Change ticket or deployment context.
RR CYBERLAB • Windows Security
Windows Event ID 7045 & New Services
Investigate newly created Windows services as possible administrative changes or persistence-related evidence.
QUICK READ
Event ID 7045 can record the creation of a new service. A new service may be legitimate software installation or administration, so context is essential.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Determine who or what created the service.
- Validate the executable path and publisher.
- Check whether the host was undergoing maintenance.
- Correlate with process creation and authentication events.
- Review whether the service starts automatically and whether it communicates over the network.
Example
A service created by an approved software deployment during a maintenance window may be expected. A similarly named service with an unfamiliar binary outside a change window requires deeper investigation.Common mistakes
- Calling every new service persistence.
- Ignoring software deployment schedules.
- Failing to validate the binary and account.
Daily quiz hook
What context should you validate before classifying a new Windows service as suspicious?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
Service installation events can help identify persistence or a legitimate software deployment. Validate service name, binary path, start type, installer or change ticket, creating account, host role, and nearby process events before escalating.
In the simulated case, compare the service’s creation time with deployment activity and inspect the path and owner. A new service is an investigation lead, not a verdict; follow local change records and preserve evidence before remediation.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.