EID 7045 triage query
Query new service installations in the last 24 hours: `Get-WinEvent -FilterHashtable @{LogName='System';Id=7045;StartTime=(Get-Date).AddHours(-24)} | ForEach-Object { $xml=[xml]$_.ToXml(); [PSCustomObject]@{Time=$_.TimeCreated;Name=($xml.Event.EventData.Data|?{$_.Name -eq 'ServiceName'}).'#text';Path=($xml.Event.EventData.Data|?{$_.Name -eq 'ServiceFileName'}).'#text';Account=($xml.Event.EventData.Data|?{$_.Name -eq 'ServiceAccount'}).'#text'} } | Format-Table -AutoSize` — high priority if `ServiceFileName` is outside `%windir%` or `Program Files`
EID 4697 — who installed it
Identify the account that performed the installation in the Security log: `Get-WinEvent -FilterHashtable @{LogName='Security';Id=4697;StartTime=(Get-Date).AddHours(-24)} | Select-Object TimeCreated,Message | Format-List` — installation by a non-administrator account is a critical finding
Collect registry evidence
Export a snapshot of the SCM hive for chain-of-custody: `reg export "HKLM\SYSTEM\CurrentControlSet\Services" C:\IR\services_export.reg /y`
Verify binary signature
Obtain the digital signature and SHA-256 hash of the service file: `Get-AuthenticodeSignature -FilePath "<ServiceFileName>" | Select-Object Status,SignerCertificate` and `Get-FileHash -Path "<ServiceFileName>" -Algorithm SHA256` — `NotSigned` or `HashMismatch` is highly suspicious; compare the hash against a TI platform
ServiceDll hijack scan
Scan `Parameters\ServiceDll` values for unexpected paths: `Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" -Recurse | Where-Object {$_.Name -like '*Parameters*'} | Get-ItemProperty -Name ServiceDll -ErrorAction SilentlyContinue | Where-Object {$_.ServiceDll -notmatch '^C:\\Windows\\' -and $_.ServiceDll -notmatch '^C:\\Program Files'} | Select-Object PSPath,ServiceDll`
Sysmon EID 13 correlation
Query SIEM for `RegistryEvent (Value Set)` events on `ImagePath` or `Parameters\ServiceDll`; record the `TargetObject` and `Details` fields — changes originating from an image other than `services.exe`/`msiexec.exe`/`TrustedInstaller.exe` are suspicious
Unquoted path scan
Detect service paths that are unquoted and contain spaces: `Get-CimInstance -ClassName Win32_Service | Where-Object {$_.PathName -match ' ' -and $_.PathName -notmatch '^"'} | Select-Object Name,PathName,StartMode`
Determine the affected scope
Query EDR/SIEM to determine whether the same `ServiceFileName` SHA-256 hash is present on other machines in the environment; assess lateral spread
