DFIRHub

Windows event log ยท System7040 Start type of a service has changed

  • System
  • 2 fields
  • System.evtx
  • Service Control Manager

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • ExecutableInfo%param4%
    • %param4% = /Event/EventData/Data[@Name="param4"]
  • PayloadData1The start type of the %param1% was changed from %param2% to %param3%
    • %param1% = /Event/EventData/Data[@Name="param1"]
    • %param2% = /Event/EventData/Data[@Name="param2"]
    • %param3% = /Event/EventData/Data[@Name="param3"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-2693123412f4}" EventSourceName="Service Control Manager"/>
    <EventID Qualifiers="12345">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2020-07-19 17:18:05.679123"/>
    <EventRecordID>744679</EventRecordID>
    <Correlation/>
    <Execution ProcessID="679" ThreadID="8972"/>
    <Channel>System</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/System_Service-Control-Manager_7040.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)