System Event ID 7045: new service installed
What System Event ID 7045 (new service installed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 7045 in the System log means a new service was installed. Remote execution tools such as PsExec work by installing a service, and so do many attack frameworks, so this event is one of the most reliable signs of lateral movement on Windows.
The fields that matter
| Field | What it tells you |
|---|---|
| Service Name | For example PSEXESVC, or a random string. |
| Service File Name | The command the service runs. This is the field to read. |
| Service Type | User-mode service or kernel driver. |
| Service Start Type | Demand start, auto start and so on. |
| Service Account | Usually LocalSystem. |
What is normal
Software installs, driver updates and management agents installing their services.
When System Event ID 7045 is suspicious
- Service file names with
cmd.exe /c,powershell,%COMSPEC%or-enc. - Binaries in
Temp,ProgramData,Usersor theADMIN$share. - Short random service names, or
PSEXESVCon hosts where nobody should be running PsExec. - New kernel drivers from unusual paths: attackers load vulnerable drivers to turn off security tools.
Common false positive: IT staff use PsExec and remote support tools legitimately. Know who does, from where, and alert on everyone else.
Find System Event ID 7045 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
Event
| where TimeGenerated > ago(7d) and EventLog == "System" and EventID == 7045
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated descRelated events
- Event ID 4697: Service installed
- Event ID 4688: New process created
- Event ID 4624: Successful logon
- Event ID 4698: Scheduled task created
FAQ
What is the difference between 7045 and 4697?
7045 is in the System log and is always written. 4697 is the Security log version and needs "Audit Security System Extension". Both describe the same service install.
How do I see where a remote service install came from?
Look for a type 3 logon (4624) on the same host just before the 7045. Its source address is the machine that pushed the service.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.