Windows services

Location & availability

SYSTEM hive: Services; System service-control events and Security service-installation events where audited

Event IDs and fields depend on the channel and version. Historical evidence can outlast or differ from current configuration.

Fields to examine

• Service name, binary path, start type and account.
• Recorded installation or state-change event.
• Image identity and relevant event outcome.

What it can establish

• Support an installed service configuration or a specific logged state change.

What it cannot prove

• Prove execution from a registry definition alone.
• Identify a malicious driver solely from an unfamiliar service name.

Use it in a screenshare

1. Export relevant configuration and service events before changing service state.
2. Inspect the complete binary path and arguments. Resolve environment variables against the examined host rather than the investigator’s computer.
3. Correlate a service start with process/driver telemetry and exact file identity. Consider legitimate game anti-cheat, hardware and security drivers.

Worked example

A service installation event names a driver near the session. This supports installation of the recorded service. Identify its publisher and bytes and seek load/runtime evidence before alleging activity inside the game.

Cross-check the finding

• Security event 4688 →Support process creation recorded by the audited host.
• Sysmon event logs →Link configured process telemetry and subsequent events through ProcessGuid.
• Run and RunOnce keys →Support that a command was configured under a startup mechanism at collection.

Sources

• Microsoft — service installation event 4697 ↗
• Microsoft — Autoruns ↗