Services Forensics Cheat Sheet

What it is

Every Windows service and kernel driver is registered by the Service Control Manager (SCM) as a subkey of Services in the SYSTEM hive. The subkey holds the binary to run, the start mode and the account. Creating a service needs administrative rights, and auto-start services run as SYSTEM by default. That makes services a classic place for persistence, and remote service creation (PsExec, Impacket, sc \\host create) a classic lateral movement technique.

Services leave two kinds of evidence: the registry configuration, which shows what is installed now, and event log records of installation and state changes.

Location

Source	Location	Windows versions
Service configuration	SYSTEM hive: `ControlSet00x\Services\<ServiceName>` (live: `HKLM\SYSTEM\CurrentControlSet\Services`)	All
svchost-hosted DLL	`...\Services\<ServiceName>\Parameters\ServiceDll` (sometimes directly under the service key)	All
svchost groups	SOFTWARE hive: `Microsoft\Windows NT\CurrentVersion\Svchost`	All
Install event	`System.evtx`, Service Control Manager event 7045	Vista and later
Install event (audit)	`Security.evtx`, event 4697	Windows 10 / Server 2016 and later, with "Audit Security System Extension"
State changes	`System.evtx`, events 7034, 7036, 7040	Vista and later

Offline hives have no CurrentControlSet: read Select\Current to know which ControlSet00x was active (control set). The hive's .LOG1/.LOG2 transaction logs can hold recent changes that were not yet written to the hive.

What it proves

A service or driver was configured to run a specific binary or command line, as a given account, with a given start mode.
Installation time and account: 7045 records the name, image path, type, start type and account; 4697 also records the SID and logon ID of the account that installed it.
Execution: 7036 shows the service entered the running state; 7034 shows it terminated unexpectedly.
It does not prove who installed a service unless 4697 is available, and the registry alone does not prove the service ever started.

Key fields

Value	Meaning
`ImagePath`	Binary or full command line; drivers use `\SystemRoot\...` or `System32\drivers\...`
`Start`	0 boot, 1 system, 2 automatic, 3 manual (demand), 4 disabled
`DelayedAutostart`	1 = automatic (delayed start)
`Type`	0x1 kernel driver, 0x2 file system driver, 0x10 own process, 0x20 shared process (svchost)
`ObjectName`	Account the service runs as (`LocalSystem`, `NT AUTHORITY\LocalService`, a user)
`DisplayName`, `Description`	Free text; often copied from real services by attackers
`Parameters\ServiceDll`	DLL loaded by `svchost.exe` for shared-process services
`FailureCommand`	Command run by the SCM when the service fails (recovery action)

Timestamps

Timestamp	Set when	Format	Pitfalls
Service key LastWrite	Any value of the key changes	FILETIME, UTC	Reflects the latest change (start type, path), not necessarily creation
7045 TimeCreated	SCM registers a new service	EVTX, UTC	Records the configuration at creation only
4697 TimeCreated	New service installed, if audited	EVTX, UTC	Later changes to path or account are not logged
7036 / 7034 / 7040	State or start-type change	EVTX, UTC	7036 is very noisy; filter by service name

Retention and clearing

The registry entry stays until the service is deleted (sc delete). A deleted service leaves its 7045 record in the System log and, sometimes, older copies of the key in shadow-copy SYSTEM hives or unallocated hive space.
The System log rolls over by size; on busy servers 7045 records for older installs may be gone. Clearing the System log creates event 104; clearing the Security log creates 1102.
4697 is not generated unless the "Audit Security System Extension" subcategory is enabled.
Tools like PsExec delete their service after use, so the registry may be clean while 7045, 7036 and the dropped binary's Prefetch remain.

Collection

KAPE target: RegistryHivesSystem (SYSTEM and SOFTWARE with transaction logs) and EventLogs. No dedicated services target exists.
Velociraptor (Windows.Triage.Targets): RegistryHivesSystem, EventLogs. Live: Windows.System.Services; Windows.EventLogs.ServiceCreationComspec finds 7045 records with COMSPEC/cmd.exe in the image path; Windows.Events.ServiceCreation monitors 7045 in real time.
Built-in:

reg save HKLM\SYSTEM E:\case\SYSTEM.hiv
wevtutil epl System E:\case\System.evtx
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} | Format-List TimeCreated, Message
Get-CimInstance Win32_Service | Select-Object Name, StartMode, StartName, PathName

Parsing tools

Registry Explorer / RECmd (Eric Zimmerman): browse Services; community batch files export service configuration to CSV.
RegRipper: services, svc and svcdll plugins (SYSTEM hive), svc_tln for timelines.
EvtxECmd (Eric Zimmerman): maps 7045, 7036, 7034, 7040 and 4697 to CSV.
Velociraptor: Windows.System.Services, with optional hashes and Authenticode checks.
Autoruns (Sysinternals, free): Services and Drivers tabs, including against an offline Windows directory.
Plaso: windows_services registry plugin.

Investigation tips

Hunt 7045 for image paths in \Users\, \ProgramData\, \Windows\Temp\ or ADMIN$, for cmd.exe /c or %COMSPEC% command lines (typical of smbexec-style tools) and for random short service names.
PSEXESVC in 7045 or in a service key points to Sysinternals PsExec; check for the PSEXESVC.EXE Prefetch file and a network logon just before.
For svchost services, the real payload is ServiceDll, not ImagePath: verify the DLL path and signature.
A service with Type 0x1 and Start 0 or 1 is a driver loading at boot; unexpected ones may be rootkits or vulnerable drivers.
Compare 7045 with the current registry: a service present in the log but absent from the hive was removed after use.
Tie the binary to Amcache (SHA-1) and look for parallel persistence in scheduled tasks and Run keys.

Windows Services

Tools