Direct answer
Use System event 7045 to identify a newly installed service, then corroborate its executable, account and timing with approved software deployment and available security events.
Identify the recorded service
Microsoft identifies System event 7045 from Service Control Manager as a service installation event and shows fields such as service name, file, start type and account. Record the device and timestamp along with the available fields; the event does not by itself prove service execution.
Reference: Microsoft: System event logs and event 7045.
Compare separate log channels
Check the Security log for event 4697 if the relevant audit policy and collection are in place. The two events have different sources and visibility requirements, so an absent event should be investigated as a potential configuration or collection gap rather than automatically treated as evasion.
Validate an example
An approved driver installer may create a service during a maintenance window. Compare its executable path, account and version with the vendor deployment record. An unfamiliar executable in a writable directory is a reason to investigate ownership and origin, not sufficient proof that the service is malicious.
Preserve and follow up
Keep the original events and associated change reference in approved storage. Involve the service owner and incident team before stopping a dependency. After an approved correction, verify both the service configuration and the intended application workflow.
Assessment limits
System and Security logs have different configuration and retention. A service installation event does not describe every later modification or action.
Frequently asked questions
Is 7045 the same log event as 4697?
No. They are different events in System and Security channels with different collection requirements.
Does a new service prove compromise?
No. Correlate its source, purpose and change record before reaching a conclusion.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.