Windows service
1actions
1reasons
2sources
Livestatus
A background program the Service Control Manager starts and stops on the host.
Identified by: sparklogs.config_change.target, which carries a name.
| Action | Reported by | What that reason says |
|---|---|---|
installed | service_installed on Windows Security event log | A Windows service was installed. This Security-channel event appears when service-install auditing is enabled; the System channel often carries the same fact by default. |
installed | service_installed on Windows System event log | A Windows service was installed. |
Example
A service was installed in the system.
channel: System
provider_name: Service Control Manager
event_id: 7045
event_data.ServiceName: ExampleSvc
event_data.ImagePath: "C:\Program Files\Example\svc.exe"
event_data.ServiceType: user mode service
event_data.StartType: auto start
event_data.AccountName: LocalSystem
SparkLogs: service_installed, Notice, service_installed: NOTABLE: A service was installed in the system.