services.exe: Windows Processes

Normal Profile

These are the values a genuine copy shows. Treat any value that differs as a lead.

Parent: wininit.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)
Path: System32 (a value that published detection rules check for)C:\Windows\System32\services.exeSources: SigmaHQ: System File Execution Location Anomaly (opens in a new tab), Velociraptor: Windows.Attack.UnexpectedImagePath (opens in a new tab)
Account: Read it from the token on a clean machine of the same build, with Get-Process -IncludeUserName live or windows.getsids in memory.
Session: Read its SessionId with Get-CimInstance Win32_Process, or windows.pslist in memory, on a clean machine of the same build.
Instances: Count copies with Get-CimInstance Win32_Process, or windows.pslist in memory, on a clean machine of the same build.
Starts: At bootSource: Microsoft Learn: Service control manager (opens in a new tab)Fast Startup hibernates the kernel session when Windows shuts down, so its start dates from the last full boot, such as a restart.
Command Line: Read it elevated with Get-CimInstance Win32_Process, or windows.cmdline in memory, and compare with a clean machine of the same build.
Signed By: Check the file with Sigcheck or Get-AuthenticodeSignature, because many Windows files are signed through a catalogue, not in the file itself.

A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.

Why It Matters

Services start as its children, so a new child of services.exe is a newly started service, and the place to look for persistence and remote execution through services. A services.exe outside System32, or with a parent other than wininit.exe, is an impostor.

What It Does

wininit.exe starts the Service Control Manager, services.exe, at boot, and it runs until Windows shuts down. A service is a program that Windows starts and manages through the Service Control Manager, at start-up or when something asks for it, and services.exe keeps the database of installed services. It is also a remote procedure call (RPC) server, so tools on another machine can manage services here too. Each service runs in a process services.exe starts, either a service host or the service program itself, under the account the service is set to use. Every new child of services.exe is therefore a service starting, so a child that no installed service names, or a service installed moments before it ran, is where to look.

Most services run either as their own program or as a DLL inside a service host, svchost.exe, and both are children of services.exe. Elastic's rule expects services.exe as the parent of svchost.exe and spoolsv.exe, and also accepts MsMpEng.exe for svchost.exe.

A new service shows in event 7045 in the System log, which Windows writes whenever a service is installed, before its process starts. Event 4697 in the Security log records it too where Audit Security System Extension is on. services.exe is on Microsoft's list of critical processes, so Windows stops with bug check 0xEF if it ends.

In a memory image, windows.svclist reads services.exe's own list of services and windows.svcscan scans memory for service records. windows.malware.svcdiff compares the two to find a service missing from the list.

How Attackers Abuse It

Each line is a way this process is misused, with the page that shows how to spot it.

A remote tool installs a service on the machine, and its binary, such as PsExec's PSEXESVC.exe, starts as a child of services.exe.Abused Built-In and Admin Tools
Malware installed as a service starts under services.exe from an unsigned binary, or one named to pass as part of Windows.Renamed, Unsigned or Falsely Signed Binaries

Red Flags

Each sign below links to the page that shows how to confirm it.

Any parent but wininit.exe, or a child that no installed service names.Wrong Parent
Any folder but System32.Wrong Path
A copy that started long after the last full boot, since it cannot restart without stopping Windows.Unusual Start Time
A child service binary that is unsigned, or named to pass as part of Windows.Renamed, Unsigned or Falsely Signed Binaries
A child named PSEXESVC.exe, the default name of PsExec's service binary.Abused Built-In and Admin Tools

How to Check It

Each page shows how to check this process, on a running machine and in a memory image.

What Records It

Each record names its log and what must be switched on to get it.

Record and Where It Lands	What to Read	How to Turn It On
7045 `New Service Installed` (opens in a new tab)`System`The Service Control Manager writes it on the computer the service was installed on.	Each new service with its image path. A service binary in a temporary or user-writable folder needs explaining.	On by default
4697 `A service was installed in the system` (opens in a new tab)`Security`It is written on the computer the service was installed on.	Service File Name, Service Type, Service Start Type and Service Account for each new service.	Turn on Audit Security System Extension.
`DeviceProcessEvents` (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced hunting	InitiatingProcessFileName services.exe marks every service process started, with its FolderPath and AccountName.	The Defender for Endpoint sensor on the device
4688 `A new process has been created` (opens in a new tab)`Security`It is written on the computer the process ran on.	Creator Process Name services.exe marks each service process as it starts, with its path.Process Trees and Call Chains shows how to read it.	Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents, with DeviceFileCertificateInfo

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it holds only copies started while the sensor ran. Check that a recent boot shows the genuine copy before you read no rows as clean. A hit is a lead until its file and creator are checked. A blank signature means unknown, not unsigned, because DeviceFileCertificateInfo holds only files the sensor has checked.

KQLDefender XDR, Advanced hunting

// services.exe copies whose parent, path or signature breaks its profileDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "services.exe"| join kind=leftouter (    DeviceFileCertificateInfo    | summarize arg_max(Timestamp, IsSigned, IsTrusted, Signer, SignatureType) by SHA1    ) on SHA1| where InitiatingProcessFileName !~ "wininit.exe"    or FolderPath !in~ (@"C:\Windows\System32\services.exe", @"C:\Windows\System32")    or IsTrusted == false| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, IsSigned, IsTrusted, Signer, SignatureType| order by Timestamp desc

Check It in the Registry: Services Service Failure Command