Lion Cipher Lab

Detect service-installation persistence with Event ID 7045 (the PsExec/new-service signal)

• SOC Analyst / Blue Team
• Intermediate
• ~35 min
• Free · no account required

Why it matters

Installing a Windows service is one of the quietest, most powerful moves an attacker has: a service runs as SYSTEM, survives reboots, and is exactly how remote-admin tools like PsExec move laterally across a network. The good news for a defender is that Windows writes a record every single time — Event ID 7045 — and, unlike many high-value events, it is on by default. If you can read that one event and tell a normal install from a malicious one, you can catch a whole class of persistence and lateral movement with telemetry you already have.

What you'll learn

• reading a Windows Event ID 7045 record and its five fields (service name, image path, service type, start type, account)
• knowing why 7045 (System log, Service Control Manager) appears by default while its Security-log companion 4697 needs an audit policy turned on
• safely reproducing the install signal with sc.exe — and dodging the trap where `sc` in PowerShell is really Set-Content
• triaging a service install: legitimate software vs PsExec-style lateral movement vs service persistence as SYSTEM
• writing a Get-WinEvent hunting query and a Sigma rule that fires on the suspicious shape, not the bare event
• mapping the behaviour to MITRE ATT&CK T1543.003 (Create or Modify System Process: Windows Service) and T1569.002 (Service Execution)
• judgment: baselining normal service installs, tuning out installer false positives, and the evasions that beat a 7045-only rule

Steps in this lab

1. What a Windows service is, and why an attacker installs one
2. The one event that catches it — by default: System log, Event ID 7045
3. Reproduce the signal safely with sc.exe (mind the PowerShell trap)
4. Find and read the 7045 record with Get-WinEvent
5. Triage: a legit install vs PsExec-style abuse
6. Turn it into a detection: a hunting query and a Sigma rule
7. Do it better — baseline, false positives, evasions, and clean up

Open the full interactive lab →