> For the complete documentation index, see [llms.txt](https://karim-ashraf.gitbook.io/karim_ashraf_space/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/lets-defend/incident-responder-path/incident-response-on-windows/services.md).

# Services

## **Analyzing Malicious Service Activity in Windows Systems**

Attackers often exploit Windows services to maintain persistence, execute malicious code, or disable security mechanisms. A thorough analysis of service-related activities is critical in identifying such threats.

***

## **Key Areas to Investigate**

1. **Newly Created or Modified Services**
2. **Disabled Security Services**

***

## **1. Detecting Newly Created or Modified Services**

**How Attackers Leverage Services:**

* **Create new services** with legitimate-sounding names (e.g., "Chrome Update").
* **Modify existing services** to execute malicious commands or scripts.

**Detection via Event Logs:**

**Event ID 4697**: A service was installed in the system.

**Steps**:

1. **Open Event Viewer**.
2. Navigate to:

   ```
   Applications and Services Logs -> Microsoft -> Windows -> Security -> Security.evtx
   ```
3. **Filter by Event ID 4697**:
   * Review the following fields in the log:
     * **Service Name**: Check for names mimicking legitimate services.
     * **Executable Path**: Validate the path to ensure the service binary is not located in suspicious directories (e.g., `C:\Temp\` or `C:\Users\Public`).

**Example**: A newly installed service `ChromeUpdate` points to `C:\Temp\malicious.exe`. This is likely malicious, as Chrome’s update service typically resides in `C:\Program Files`.

***

## **2. Identifying Disabled Security Services**

**Why Attackers Disable Security Services:**

* To **bypass protection** mechanisms such as antivirus, firewall, and Windows Defender.

**Detection via Event Logs:**

**Event IDs**:

* **7036**: A service entered the stopped state.
* **7045**: A service was installed in the system.

**Steps**:

1. Open **Event Viewer**.
2. Navigate to:

   ```
   Applications and Services Logs -> Microsoft -> Windows -> System -> System.evtx
   ```
3. **Filter by Event IDs 7036 and 7045**:
   * Identify critical services that have been **stopped** unexpectedly (e.g., Windows Defender, Firewall).

**Example**: Logs show that Windows Defender was stopped shortly before suspicious network activity. This indicates the attacker may have disabled it to run malware without detection.

***

## **Service Analysis Tools**

**1. Autoruns (Sysinternals Tool)**

* **Purpose**: Detect auto-starting services and persistence mechanisms.

**Steps**:

1. Run **Autoruns as Administrator**.
2. Go to the **Services** tab.
3. Investigate:
   * **Unfamiliar service names**.
   * **Unsigned services** or those with **no publisher information**.

**2. Command Line (CMD or PowerShell)**

**Using CMD**:

```bash
sc query state= all
```

* Lists all services, including their state (running or stopped).

**Using PowerShell**:

```powershell
Get-Service | Where-Object {$_.Status -eq 'Stopped'}
```

* Filters and lists all stopped services. Review why these were stopped, especially if they are critical security services.

***

## **Analyzing Deleted or Hidden Services**

Attackers may delete services after use to evade detection. Logs can help trace these actions.

**Log Sources:**

1. **Task Scheduler Logs**: Trace services scheduled to run periodically.
2. **Security Logs**:
   * **Event ID 4698**: Service creation.
   * **Event ID 4702**: Service modification.

**Example**: A service named `TempUpdater` was created and later deleted. Reviewing logs revealed it executed a script that established a reverse shell.

***

## **Eradication and Mitigation**

1. **Stop Malicious Services**:

   ```bash
   sc stop <service_name>
   ```
2. **Disable the Service**:

   ```bash
   sc config <service_name> start= disabled
   ```
3. **Delete the Service**:

   ```bash
   sc delete <service_name>
   ```
4. **Remove Malicious Executables**: Delete associated binaries:

   ```bash
   del C:\Temp\malicious.exe
   ```
5. **Enable Critical Security Services**: Re-enable services like Windows Defender and Firewall:

   ```bash
   sc start windefend
   sc start mpssvc
   ```

***

## **Key Takeaways**

* **Persistence via Services**: Attackers create or modify services to maintain long-term access.
* **Disabled Security Services**: A common tactic to evade detection.
* **Critical Event IDs**:
  * **4697**: Service installation.
  * **7036**: Service stopped.
  * **7045**: Service installed.

***

## **Recommended Action Steps**:

1. Regularly review **service-related logs**.
2. Investigate **newly created services** and validate their **file paths**.
3. Monitor **stopped critical services** for signs of malicious activity.
4. Use **Autoruns** and **PowerShell** for comprehensive service analysis.

By employing these methods, incident responders can effectively detect and neutralize threats involving malicious Windows services.