System Event ID 7040 — The start type of a service was changed — SecOps Tools

Why event 7040 matters

Disabling security service auto-start ensures it won't restart after reboot. Attackers change AV or EDR services from Automatic to Disabled to prevent recovery after reboot. Also: changing malicious service from Manual to Automatic = persistence.

How to detect it

Alert: security services changed to Disabled or Manual. Alert: unknown services changed to Automatic. This change survives reboots — high persistence indicator.

Log source

System

Logged by default in the System channel; no audit policy required.

Fields to pivot on

param1param2Computer

MITRE ATT&CK mapping

Tactic	Technique
Persistence	Windows Service (T1543.003)
Defense Evasion	Disable or Modify Tools (T1562.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "System" and EventID == 7040   // The start type of a service was changed
// EventData holds: param1, param2, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:System" EventCode=7040
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The start type of a service was changed — add EventData fields: param1, param2, Computer`

Hunt event 7040 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Service Control Manager events

7000 The service failed to start due to the following error 7001 The service depends on another service 7009 A timeout was reached while waiting for service to connect 7022 The service hung on starting 7023 The service terminated with an error 7024 The service terminated with a service-specific error 7026 The following boot-start or system-start driver failed to load 7031 The service terminated unexpectedly 7034 The service terminated unexpectedly and will be restarted 7035 The service was successfully sent a start or stop control 7036 The service entered the stopped/running state 7038 The service was unable to log on as the configured account

Frequently asked questions

What is System Event ID 7040?

The start type of a service was changed. Service start type modified. ServiceName, OldStartType, NewStartType are key. Start types: Automatic, Manual, Disabled.

Which log records event 7040?

Event 7040 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.

What MITRE ATT&CK techniques map to event 7040?

Event 7040 is associated with: Windows Service (T1543.003), Disable or Modify Tools (T1562.001).

How do you detect activity around event 7040?

Alert: security services changed to Disabled or Manual. Alert: unknown services changed to Automatic. This change survives reboots — high persistence indicator.