If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the Windows registry?
There is no way to determine the creation date for a particular Windows service as both the services applet and the Windows registry does not store any dates relating to creations.
There is, however, a last modified date which is hidden away from view (including in the Windows registry editor) but can be accessed using RegQueryInfoKey. Since all Windows services stored in the registry, you can check the Last Modified Date against the registry keys related to the service in question by looking in
Alternatively, if you export the registry key(s) you want information on as a text file, the last modified date for each key is written in the text file.
Starting in Vista, service creation is logged to the "System" event log under Service Control Manager event ID 7045.
For example, the following command:
C:\>sc create hello binpath= notepad.exe [SC] CreateService SUCCESS
Produced the following event log entry:
Log Name: System Source: Service Control Manager Date: 12/16/2014 3:00:00 PM Event ID: 7045 Task Category: None Level: Information Keywords: Classic User: DOMAIN\username Computer: WORKSTATION.DOMAIN.local Description: A service was installed in the system. Service Name: hello Service File Name: notepad.exe Service Type: user mode service Service Start Type: demand start Service Account: LocalSystem