7045
A service was installed in the system
- Log: System
- Source: Service Control Manager
- Tampering & persistence
- Warning
What it means
A new service was installed. Logged even when Security auditing is off.
Why it matters
A reliable place to spot remote-execution tools such as PsExec and unknown software.
What to do
- Verify the image path and that the install was expected.
Find it with PowerShell
Get-WinEvent -MaxEvents 20 -FilterHashtable @{
LogName = 'System'; Id = 7045
} | Select-Object TimeCreated, ProviderName, MessageAdd -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.
Seeing a lot of these? We can investigate, or alert you automatically through our monitoring.
Talk to us