7045 System log · Service Control Manager high severity low volume

System Event ID 7045 — A new service was installed in the system

New service installed. ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount are key. Counterpart to Security 4697.

Why event 7045 matters

Primary persistence indicator for service-based attacks. PsExec creates a temporary service (PSEXESVC or custom name) on the remote host. Ransomware installs as a service. Cobalt Strike creates services for lateral movement. ServiceFileName in temp or user paths is the key suspicious indicator.

How to detect it

Alert: ServiceFileName in %TEMP%, %APPDATA%, C:\Users\, \\UNC\\ paths. Alert: ServiceAccount=LocalSystem for user-installed services. Alert: service names that are random characters or mimic legitimate Windows services. Cross-reference with Security 4697.

Log source
System
Logged by default in the System channel; no audit policy required.
Fields to pivot on
ServiceNameImagePathServiceTypeStartTypeAccountName

MITRE ATT&CK mapping

Tactic Technique
Persistence Windows Service (T1543.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: New Service Installed from Suspicious Path
status: stable
description: Service installed from temp or user-writable directory
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
    filter_legit:
        ServiceFileName|startswith:
            - 'C:\\Windows\\'
            - 'C:\\Program Files\\'
            - 'C:\\Program Files (x86)\\'
    condition: selection and not filter_legit
falsepositives:
    - Software installations
    - IT management agents
level: high
tags:
    - attack.persistence
    - attack.t1543.003
Sentinel / Defender KQL
Event
| where EventLog == "System" and EventID == 7045   // A new service was installed in the system
// EventData holds: ServiceName, ImagePath, ServiceType, StartType, AccountName
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:System" EventCode=7045
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A new service was installed in the system — add EventData fields: ServiceName, ImagePath, ServiceType, StartType`
Hunt event 7045 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Service Control Manager events

7000 The service failed to start due to the following error 7001 The service depends on another service 7009 A timeout was reached while waiting for service to connect 7022 The service hung on starting 7023 The service terminated with an error 7024 The service terminated with a service-specific error 7026 The following boot-start or system-start driver failed to load 7031 The service terminated unexpectedly 7034 The service terminated unexpectedly and will be restarted 7035 The service was successfully sent a start or stop control 7036 The service entered the stopped/running state 7038 The service was unable to log on as the configured account

Frequently asked questions

What is System Event ID 7045?

A new service was installed in the system. New service installed. ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount are key. Counterpart to Security 4697.

Which log records event 7045?

Event 7045 is written to the System channel by Service Control Manager / Kernel. Logged by default in the System channel; no audit policy required.

What MITRE ATT&CK techniques map to event 7045?

Event 7045 is associated with: Windows Service (T1543.003).

How do you detect activity around event 7045?

Alert: ServiceFileName in %TEMP%, %APPDATA%, C:\Users\, \\UNC\\ paths. Alert: ServiceAccount=LocalSystem for user-installed services. Alert: service names that are random characters or mimic legitimate Windows services. Cross-reference with Security 4697.