Event ID 7045 is a Windows System event, from the Service Control Manager, that records when a service is installed. It can indicate normal software deployment or an attacker establishing persistence. Review the service name and installation context, and check whether the new service aligns with approved change activity.
What Event ID 7045 Means in Practice
Event ID 7045 is most useful because it marks a service installation point, which can be routine during approved software deployment or a sign that an adversary is creating a persistence mechanism. The security value comes from treating the event as context, not proof: you need the service name, account context, binary path, and change window to interpret it correctly.
When a new service appears unexpectedly, the key question is whether it matches known administration, software rollout, endpoint management, or backup activity. A service that does not align with approved change activity deserves faster review because service-based persistence is durable and often blends in with normal Windows administration.
How to Investigate a Service Installation Event
Start with the event record itself, then correlate it with nearby logons, process creation, and configuration activity to understand who installed the service and from where. The service’s executable path, display name, start type, and related command line often reveal whether the installation was legitimate or a staged foothold.
It also helps to compare the event against your asset inventory and software deployment records. On managed Windows hosts, a service install may be expected on one endpoint and suspicious on another, so interpretation depends on host role, change timing, and whether the service binary lives in an approved location.
For teams that rely on Windows log review as a detection control, NHIMG’s Windows Event Log Guide is a useful companion because it places Event ID 7045 alongside the other Windows event IDs that matter for change, persistence, and audit review.
Why Service Installation Is a Persistence Tactic
Services are attractive to attackers because they can start automatically, run with elevated privileges, and survive reboots. That makes a malicious service a dependable persistence mechanism, especially when defenders focus only on interactive logons and overlook service creation as an execution path.
Service installs can also support follow-on activity such as lateral movement, credential theft, or staging of additional payloads. A suspicious 7045 event therefore matters not only as a sign of installation, but as a marker that the host may already be part of an intrusion sequence.
For defenders who want broader detection coverage around the host, NHIMG’s Sysmon Guide helps connect service creation to adjacent telemetry that can show process ancestry, registry activity, and tamper attempts.
Detection, Review, and Hardening After the Event
When Event ID 7045 looks suspicious, review whether the service binary is signed, where it was written, and whether the install was followed by unusual network activity or privilege use. A clean-looking service name is not enough; attackers often choose names that resemble legitimate vendor or Windows components.
If compromise is confirmed or strongly suspected, investigate the service account, any credentials used to create it, and any systems the new service could reach. The safest response is to remove the service only after preserving evidence and determining whether it was part of a broader intrusion chain.
Hardening should focus on reducing silent service creation, tightening administrative change control, and improving alerting for service installs on sensitive systems. Service creation events become much more valuable when they are reviewed alongside baseline software installation patterns rather than in isolation.
For Windows-heavy environments, NHIMG’s PowerShell Security Guide can help when the service was created through scripts or remote administration tooling.
When Event ID 7045 Matters Most
Event ID 7045 is especially important on servers, domain-joined endpoints, and systems that should rarely receive new services outside a controlled change process. In those environments, the event is often less about the service itself and more about whether the installation fits the expected operational story.
It becomes a stronger indicator of compromise when it appears with an unfamiliar binary path, an unexpected creator account, or a service that starts immediately after installation. In those cases, the event is a pivot point for deeper host review, not a standalone alert to close.
For service and account activity that may accompany persistence, NHIMG’s Kerberos Security Guide is relevant when the intrusion path includes credential misuse, ticket abuse, or other authentication-related follow-on activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Event 7045 is a log review problem that needs correlation and analysis. |
| SI-4 — System Monitoring | Service installation is a monitoring signal for suspicious host behavior and persistence. | |
| CM-3 — Configuration Change Control | A new service is a configuration change that should align with approved change activity. | |
| Recommendation — Review service-install events with correlated audit data to distinguish approved change from persistence. Monitor for unexpected service creation and alert on anomalous install context. Require approved change control for new Windows services on managed systems. | ||
| MITRE ATT&CK | T1543.003 — Create or Modify System Process, Windows Service | Event ID 7045 commonly maps to Windows service creation used for persistence. |
| Recommendation — Map suspicious 7045 events to Windows service persistence hunting and containment. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Service-install events are most useful when logging is centralized, retained, and reviewed. |
| Recommendation — Centralize and review logs so new-service activity can be detected and investigated. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org