This event, logged to the System channel, is produced when a new service is installed on the system.
Analysis Value
Operating System Availability
Major Version
Support
Major Version
Support
Windows 11
✅
Server 2019
✅
Windows 10
✅
Server 2016
✅
Windows 8
✅
Server 2012
✅
Windows 7
✅
Server 2008
✅
Windows Vista
✅
Server 2003
❌
Windows XP
❌
Artifact Location(s)
%SystemRoot%\System32\Winevt\Logs\System.evtx
Artifact Interpretation
Field
Interpretation
Reference
System/Security/UserID
This field provides the SID of the account that installed the new service.
EventData/ImagePath
This field provides the full path to the executable that will be run when the new service is started.
There is no indication from this event alone that it was installed locally on the system itself, and services may be installed remotely leveraging utilities such as sc.exe. In the event that the new service was installed remotely, as EventID 4624: An account was successfully logged on event may be logged before the new service is installed with a LogonType of 3.
Example
In the following example, the following command was executed on a domain controller:
sc.exe \\WKS10-01 create mynewservice binpath= c:\temp\example.exe start= auto displayname= "My new service"