DFIRHub

Windows event log ยท System7045 A new service was installed in the system

  • System
  • 4 fields
  • System.evtx
  • Service Control Manager

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1Name: %ServiceName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
  • PayloadData2StartType: %StartType%
    • %StartType% = /Event/EventData/Data[@Name="StartType"]
  • PayloadData3Account: %AccountName%
    • %AccountName% = /Event/EventData/Data[@Name="AccountName"]
  • ExecutableInfo%ImagePath%
    • %ImagePath% = /Event/EventData/Data[@Name="ImagePath"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager"/>
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-05-07 19:24:11.6922354"/>
    <EventRecordID>382</EventRecordID>
    <Correlation/>
    <Execution ProcessID="620" ThreadID="1196"/>
    <Channel>System</Channel>
    <Computer>win10-test</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="ServiceName">vmxnet3 NDIS 6 Ethernet Adapter Driver</Data>
    <Data Name="ImagePath">\SystemRoot\System32\drivers\vmxnet3.sys</Data>
    <Data Name="ServiceType">kernel mode driver</Data>
    <Data Name="StartType">demand start</Data>
    <Data Name="AccountName"></Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/System_Service-Control-Manager_7045.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)