thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Event ID 7045

The Windows System event recorded when a new service is installed.

Definition

Attackers install services for persistence or remote execution, as tools such as PsExec create a temporary service (PSEXESVC). Event 7045 includes the service name and binary path, making it valuable for detecting lateral movement and persistence.

Example

7045 showing a service with a random name executing a PowerShell command from %COMSPEC%.

Exam tip

New services with random names or command-line paths indicate PsExec-style lateral movement or persistence.

Related terms