skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-unusual-service-installations

Detect suspicious Windows service installations by parsing System event logs for Event ID 7045.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat hunting#windows services#evtx parsing#persistence detection#t1543.003#event id 7045
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-unusual-service-installations
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-unusual-service-installations
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-unusual-service-installations
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-unusual-service-installations

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml.

What problem does it solve?

Attackers install malicious Windows services for persistence and privilege escalation (MITRE ATT&CK T1543.003), and manually reviewing event logs for these installations is slow and error-prone. This Skill automates the hunt by parsing .evtx logs and flagging suspicious service creation activity.

Core Features & Use Cases

  • Event Log Parsing: Extracts Event ID 7045 records from System.evtx, capturing service name, binary path, service type, and account.
  • Suspicious Indicator Detection: Flags services with binaries in temp directories, PowerShell or cmd.exe based creation, encoded commands, and LocalSystem services with unusual paths.
  • ATT&CK-Mapped Reporting: Produces a JSON report with risk scores, remediation recommendations, and a timeline mapped to MITRE ATT&CK T1543.003.
  • Use Case: A SOC analyst investigating a suspected intrusion can point this Skill at collected System.evtx files to quickly surface persistence mechanisms such as PsExec-style transient services or svchost-hosted malicious ServiceDll payloads.

Quick Start

Analyze the attached System.evtx file for unusual service installations and generate a threat hunting report mapped to MITRE ATT&CK T1543.003.

Frequently Asked Questions about hunting-for-unusual-service-installations

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malicious Windows service installations in event logs?▼

Parse the System event log for Event ID 7045, which records every new service installation. Extract the service name, binary path, type, and account, then flag suspicious indicators like temp-directory paths, PowerShell or cmd.exe binaries, and encoded commands.

What tools parse Windows .evtx event log files in Python?▼

The python-evtx library parses binary .evtx files, with lxml handling the XML event records. This Skill requires Python 3.9+ with both packages installed to extract Event ID 7045 service installation data.

Does Event ID 7045 catch modifications to existing services?▼

No, Event ID 7045 only logs new service installations, not changes to existing services. To catch ImagePath modifications via sc config or registry edits, hunt Event ID 4697 or Sysmon Event ID 13 on the Services registry keys.

How do I detect svchost-hosted malicious services?▼

For svchost-hosted services, the payload lives in the ServiceDll value under the service's Parameters registry key, not in ImagePath. Inspect that value and cross-check Sysmon Event ID 6 for malicious kernel driver loads.

How do I reduce false positives when hunting service installations?▼

Baseline legitimate signed vendor agents such as EDR and backup tools, plus built-in Windows services, by signer and path. Validate coverage by running Atomic Red Team test T1543.003 and confirming 7045 events capture ImagePath and ServiceType.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-persistence-mechanisms-in-windows

Identify adversary persistence mechanisms in Windows endpoints via registry keys, services, scheduled tasks, and WMI subscriptions.

Official
Advanced
wgpsecwgpsec
1.7k

emergency-response

Investigate compromised Linux and Windows hosts through account, process, persistence, and log analysis.

Official
Advanced
fractaryfractary

ops-investigator

Query CloudWatch logs to investigate incidents and generate reports.

Official
Intermediate
FuzzdkkFuzzdkk
3

log-analysis

Parse and analyze security logs to detect anomalous activity.

Community
Intermediate