Log Dejargonizer

Windows System Log · Event 7045

Event 7045: A new service was installed

A service was registered with Windows. It is available by default with no audit policy to configure, which makes it one of the most practical persistence signals you can collect — and remote execution tools give themselves away here constantly.

Also written as Event ID 7045Service Control Manager 7045New service installedservice was installed 7045

What it means for you

On a personal computer

A program registered a background component that will start with Windows. Expected right after installing software. Worth questioning if you have not installed anything.

For an analyst

Collect this everywhere. Unlike Security event 4697 it needs no audit policy, so it works on machines nobody configured. The trade-off is that it does not record which account performed the installation — collect 4697 as well where you can. The service file name is the field that carries the signal.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A service was installed in the system.

Service Name:  WinHelpSvc
Service File Name:  C:\Users\jbrooks\AppData\Local\Temp\wh.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem

The fields that decide it

Everything else in the log line is context.

Service Name
The registered name. Names imitating Windows components are a common disguise, as are random strings.
Service File Name
The command line the service runs. Read this before anything else.
  • A path under Program Files or System32Where legitimate services live.
  • A path under a temp directory or user profileServices do not normally live here.
  • cmd.exe or powershell.exe with argumentsA service that exists only to run a command. This is how several remote execution tools operate.
  • A path containing an encoded or base64 stringAlmost never legitimate.
  • An unquoted path containing spacesA privilege escalation weakness regardless of intent.
Service Type
User mode service or kernel mode driver. Driver installations deserve more scrutiny.
Start Type
auto start means it survives reboots, which is the point of persistence. demand start means it runs only when asked.
Service Account
The account it runs as. LocalSystem is full privilege.

Ordinary reasons this happens

Most of the time it is one of these.

  • Installing ordinary software, most of which registers at least one service.
  • Windows updates and driver installations.
  • Deploying management, backup, or security agents.
  • Virtualisation and container tooling.
  • Legitimate remote administration tools, which register a temporary service to run commands — the same mechanism attackers use.

When it is not ordinary

Persistence through an automatically starting service.

What gives it awayA service pointing at a binary outside normal software directories with an automatic start type.

ATT&CK T1543.003

Remote command execution across the network.

What gives it awayA short-lived service whose file name is a command interpreter with arguments, often with a randomly generated service name.

ATT&CK T1569.002

Loading a driver to interfere with security tooling.

What gives it awayA kernel driver service registered outside a driver installation, particularly one that is signed but known to be vulnerable.

ATT&CK T1547.006

A service disguised as a Windows component.

What gives it awayA service name close to a genuine Windows service but with a path that does not match where the real one lives.

ATT&CK T1036.005

What to do next

  1. Read the service file name first. The path answers most of the question on its own.
  2. Check whether a software installation was under way on that machine at that time.
  3. Compare the service name against the services on a known-good machine of the same build.
  4. Count how many machines have the same service. Present everywhere means it is your tooling; present on one means look harder.
  5. If the service runs a command interpreter, treat it as remote execution and find where the connection came from — check 5140 for ADMIN$ access just before.
  6. Correlate with 4697 in the Security log, which names the account that performed the installation.

Queries to run

kql Services running from unusual locations or executing a shell. Short list, high value. 
Event | where EventLog == 'System' and EventID == 7045 | extend Path = extract(@'Service File Name:\s*(.+)', 1, RenderedDescription) | where Path has_any ('\\Temp\\','\\Users\\','\\AppData\\','cmd.exe','powershell.exe','%COMSPEC%') | project TimeGenerated, Computer, RenderedDescription
kql Services that appear on only one or two machines. Your own software will be everywhere; this is the tail. 
Event | where EventLog == 'System' and EventID == 7045 | extend Name = extract(@'Service Name:\s*(.+)', 1, RenderedDescription) | summarize hosts = dcount(Computer), first = min(TimeGenerated) by Name | where hosts <= 2 | order by first desc
powershell A month of service installations on one machine. A good first command when investigating a suspected compromise. 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-30)} | Select-Object TimeCreated, Message | Format-List
sigma Portable starting point. Tune the exclusions for your own deployment tooling rather than dropping the rule. 
detection:
  selection:
    EventID: 7045
    ServiceFileName|contains:
      - '\\Temp\\'
      - '\\AppData\\'
      - 'cmd.exe /c'
      - 'powershell'
  condition: selection

Common questions

Is Event 7045 a sign of malware?

Not by itself — every ordinary software installation produces one. What makes it suspicious is the service file name. Legitimate services run binaries from Program Files, System32, or a vendor directory; a service pointing at a temp folder, a user profile, or a command interpreter is not a normal installation regardless of what it calls itself.

What is the difference between Event 7045 and Event 4697?

They record the same event from different logs. 7045 is in the System log and is available by default on every Windows machine. 4697 is in the Security log, requires the Audit Security System Extension subcategory to be enabled, and additionally records which account performed the installation. Collect 7045 for coverage and 4697 for attribution.

Why do remote administration tools show up as Event 7045?

Because that is genuinely how they work. Tools that run commands on a remote machine typically copy a small executable to the admin share, register it as a service, start it, and remove it afterwards. Legitimate administration and attacker lateral movement produce almost identical events, which is why the service name and path matter more than the technique.

How far back does Event 7045 go?

As far as your System log retention allows, which by default is a rolling size limit rather than a time limit — often only a few weeks on a busy machine. If you care about service installations historically, forward them off the host, because the local log will roll over long before you need it.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026