11

If on a compromised system you are trying to analyze newly installed services or when services were installed, how do you do that. Where can I find the creation date for a certain service in the Windows registry?

migrated from security.stackexchange.com Dec 16 '14 at 22:39

This question came from our site for information security professionals.

19

There is no way to determine the creation date for a particular Windows service as both the services applet and the Windows registry does not store any dates relating to creations.

There is, however, a last modified date which is hidden away from view (including in the Windows registry editor) but can be accessed using RegQueryInfoKey. Since all Windows services stored in the registry, you can check the Last Modified Date against the registry keys related to the service in question by looking in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Alternatively, if you export the registry key(s) you want information on as a text file, the last modified date for each key is written in the text file.

enter image description here

Finally, a solution using PowerShell to return the Last Modified Date has already been discussed on Stack Overflow.

  • Alas this ain't working for me. I get No Last Write Time when exporting Services – Chris F Carroll Dec 14 '17 at 11:04
7

Starting in Vista, service creation is logged to the "System" event log under Service Control Manager event ID 7045.

For example, the following command:

C:\>sc create hello binpath= notepad.exe
[SC] CreateService SUCCESS

Produced the following event log entry:

Log Name:      System
Source:        Service Control Manager
Date:          12/16/2014 3:00:00 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          DOMAIN\username
Computer:      WORKSTATION.DOMAIN.local
Description:
A service was installed in the system.

Service Name:  hello
Service File Name:  notepad.exe
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem
  • Is there any way to access the event log entry from the registry? – RoraΖ Dec 16 '14 at 20:41
  • No, they are separate things. – Andrew Medico Dec 16 '14 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.