Skip to main content
AD Academy
Back to all events
7045SystemSecurity & attacksWARNLast updated:

A new service was installed

What it means

A new service was registered. PsExec, Cobalt Strike and many lateral-movement tools leave traces here.

First steps

  1. 1Check Service File Name — a Temp path or random name is suspicious.
  2. 2Correlate with 4624 Type 3 from the same source.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.