This note documents detection patterns related to Service Installer Persistence within Windows environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
System	7045	Service installed	Critical	Primary detection point. Review service name, display name, binary path, start type, service account, and installer account.
System	7036	Service state changed	High	Confirms service start / stop activity after installation.
Security	4697	Service installed	Critical	Native Security log equivalent when auditing enabled; includes subject user context.
Sysmon	1	Process creation	Critical	Hunt for `sc.exe`, `powershell.exe`, `cmd.exe`, `services.exe`, parent chain and command line.
Security	4688	Process creation	High	Command-line visibility often reveals `create`, `binPath=`, `start=` usage.
Sysmon	13	Registry value set	High	Service registration writes under `HKLM\SYSTEM\CurrentControlSet\Services`.
Sysmon	12	Registry key create/delete	High	New service key creation visible here.
Sysmon	11	File create	High	Service binary often dropped immediately before install.
PowerShell	4104	Script block logging	Critical	Captures `New-Service`, WMI service creation, CIM methods.
Sysmon	7	Image loaded	Medium	Useful when malicious DLL service loaders execute.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Service name mimicry	"Windows Update Helper", "Defender Core", "Network Telemetry"	Critical	Common stealth tactic.
Unsigned binary	Unsigned or unknown publisher	Critical	Strong malicious signal.
Binary path in writable directory	AppData, Temp, Public, ProgramData	Critical	Very strong persistence signal.
Service starts immediately after creation	Rapid 7045 → 7036 sequence	High	Common attacker pattern.
Service account anomaly	Runs under LocalSystem unexpectedly	High	Elevates persistence impact.
Existing service modified	Legitimate binary path changed	Critical	Common stealthier attacker method.
DLL service abuse	svchost-hosted custom service DLL	High	Requires registry ServiceDLL review.
Remote service creation	Service installed from another host	High	Strong lateral movement indicator (PsExec / SCM abuse).
Service binary deleted later	7045 present but binary missing	High	Cleanup / ephemeral payload clue.
Beacon follows service start	Outbound network immediately after 7036	High	Correlate with Sysmon 3 / EDR net telemetry.

Common Tools

Tool	Usage
sc.exe	Native service creation (`create`, `config`, `delete`)
PowerShell	`New-Service`, CIM/WMI service creation
PsExec	Remote service deployment via SCM
Cobalt Strike	Service persistence / remote exec
SharpPersist	Service persistence module
Empire	Service persistence
Impacket psexec.py	Remote service-based execution
Custom SCM API tooling	Direct `CreateServiceW` abuse

Relevant Artifacts

System log: 7045, 7036
Security log: 4697
Registry: HKLM\SYSTEM\CurrentControlSet\Services\
Service binary path on disk
Service DLL: Parameters\ServiceDLL (for DLL-backed services)
Sysmon: 1, 11, 12, 13
Security 4688 with command line enabled
PowerShell logs: 4103 / 4104
Prefetch: SC.EXE, POWERSHELL.EXE, CMD.EXE, PSEXESVC.EXE
Amcache / ShimCache
MFT / USN Journal for binary drop and registry-linked timing
SRUM if service payload initiates network communication
EDR process trees: services.exe → child process lineage

MITRE ATT&CK References

T1543.003 Windows Service
T1543 Create or Modify System Process
T1569.002 Service Execution

Decision Tree

Was a service installed?
- Check 7045 / 4697
What created it?
- Pivot to 4688 / Sysmon 1
- Identify:
  - sc.exe
  - powershell.exe
  - remote SCM source
Binary analysis
- Path
- Signature
- Hash
- Writable directory?
Service type
- Own process
- Shared process
- DLL-backed
Pivot:
- Did it start immediately?
- Child process spawned?
- Network beacon?
Scope:
- Single host?
- Remote lateral deployment?
- Legitimate software install?

Example Detection Templates

KQL

System
| where EventID == 7045
| project TimeGenerated, Computer, EventData
| order by TimeGenerated desc

SecurityEvent
| where EventID == 4697
| project TimeGenerated, Computer, Account, EventData

Sysmon
| where EventID == 1
| where CommandLine has_any ("sc create", "New-Service")
| project TimeGenerated, Computer, User, Image, CommandLine, ParentImage

Sysmon
| where EventID == 13
| where TargetObject has @"\Services\"

EQL

process where process.command_line like "*sc create*" or process.command_line like "*New-Service*"

sequence by host.name with maxspan=5m
  [ process where process.command_line like "*sc create*" ]
  [ any where event.code == "7045" ]

Sigma

title: Suspicious Service Installation
id: 5f91b3de-service-installer
status: experimental
description: Detects Windows service installation often associated with persistence or lateral movement
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Vergil
date: 2026-03-07
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  condition: selection
fields:
  - ServiceName
  - ImagePath
  - AccountName
falsepositives:
  - Legitimate software installation
  - Patch deployment systems
  - Enterprise management tools
level: high
tags:
  - attack.persistence
  - attack.t1543.003

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Service install monitoring	Alert on 7045 / 4697	Critical	Core detection coverage
Baseline legitimate services	Maintain known-good inventory	Critical	Prevent false positives
Restrict SCM rights	Limit who can create services	High	Reduces abuse surface
Binary signature validation	Alert on unsigned service binaries	High	Strong detection enhancer
Service DLL review	Inspect ServiceDLL regularly	High	Detect DLL-backed stealth services
EDR service lineage	Monitor services.exe child activity	Critical	High-confidence malicious service detection