Windows Event ID 7045 — New Service Installed
Logged when a new service is installed on the system. The System log equivalent of Security Event 4697.
MITRE ATT&CK
T1543.003 · Windows Service
Persistence
Why It Matters
Service installation is a primary persistence technique. Malware frequently installs itself as a service to survive reboots. Suspicious service names, binary paths in user-writable directories, and services using cmd.exe or PowerShell are key indicators.
Key Fields
Investigation Tips
- 1.Service binaries in C:\Users, C:\Temp, C:\ProgramData, or C:\Windows\Temp are almost always malicious.
- 2.Services with command-line embedded in the binary path (e.g. cmd.exe /c powershell.exe ...) are classic persistence.
- 3.Cross-reference with 4697 (Security log) for the account that installed it.
Seeing Event ID 7045 in your own logs? Upload an .evtx file — EventPeeker flags new service installed automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Have Event ID 7045 open in Event Viewer?
In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.
Go deeper: the full Event ID 7045 — New Service Installed guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the Event ID 7045 — New Service Installed guide →See Event ID 7045 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects new service installed patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →