Services
Every service and driver, with the binary it runs and how it starts.
Use it to find a malicious service, with the program it runs, the account it runs as and whether it starts at boot.
- SYSTEM
- Persistence
What It Is
The Services key lists every Windows service and driver, with the program each one runs, the account it runs as and how it starts. A service runs in the background, often as the all-powerful LocalSystem account and often from boot with nobody signed in, which is why attackers install one to keep a foothold. Each service is a subkey, and the values ImagePath, Start and ObjectName hold the binary, the start type and the account.
What It Proves
A service with that ImagePath is installed, and with Start set to 2 it runs at every boot without anyone logging on. The subkey's last write time dates its latest change.
What It Does Not Prove
Hundreds of subkeys are normal, so you are hunting for the odd one out. It does not show whether the service ran or who installed it.
Where It Lives
Services lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The service runs C:\ |
| Start 2 means it starts automatically at every boot, with nobody logged on. That is how it survives a restart. |
| It runs as LocalSystem, the most powerful local account. Whatever the binary does, it does with full control of the machine. |
| It calls itself Windows Update Helper, a name chosen to blend in. Judge a service by its ImagePath and key last write time, not its name. |
How to Read It
Sort the subkeys by last write time and look at the newest first. Check ImagePath, or Parameters\ServiceDll for svchost services, for Temp, AppData or odd names. Start 2 is automatic at boot, 0 and 1 are drivers loaded early, 3 is manual and 4 disabled.
- When Windows Writes It
- When a service is installed, changed or removed, by an installer, sc.exe or the Service Control Manager.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
The live tools that record Registry writes catch a service being installed or changed, and process creation records show its binary running. The System log also records every service install in event 7045.
Defender records writes to service keys. DeviceEvents with ActionType ServiceInstalled is a quick second check.
// New or changed service binaries (ImagePath) on the deviceDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Services shows.
- AmcacheGives the service binary's SHA-1, to check it even after the file is gone.
- Service Installed, System Event 7045Not in the RegistryRecords when the service was installed, with its name and binary path.
- Service Installed, Security Event 4697Not in the RegistryNames the account that installed it, if Security System Extension auditing is on.
Sources
The facts on this page come from these public pages, which say more on each point.