Quick trivia from today’s shift: when we kick off a 15-minute triage per our IR playbook, which single Windows event ID do you check first to spot lateral movement via rogue service creation, and why? I default to System log 7045 because it shows service installs with account context, but I’m curious what others lean on during initial SIEM scoping before pivoting to Sysmon.
I start with Security 4697 (“A service was installed”) because it gives the subject SID and target service name straight from the audit log, which is faster to pivot than Sysmon in a 15-minute triage… If that audit isn’t enabled in your baseline, I fall back to 7045 with a quick look for a matching 4624 Type 3 on the same host — do you have 4697 turned on?
For a 15-minute triage I still lead with System 7045 because it’s default-on and the Service File Name (ImagePath) is gold for catching over-the-wire drops. I quick-filter for ImagePath containing \ (UNC), C:\Windows\Temp, or ProgramData, then if Security auditing’s solid I confirm with 4697 for the subject SID — @cj_wang84 do you also key on UNC paths in your first sweep?
Same here with 7045, but my quick win is to filter ImagePath for UNC/admin shares or user‑writable dirs: ^\, C:\Windows\Temp, C:\Users\Public; those bubble true svc‑create lateral moves fast. @jgreenwood22 do you also flag random 8‑char service names or binPath without quotes?
But i lean on Security 4688 filtered to ‘ParentImage=services.exe’; it surfaces the payload the new service runs, even when 7045/4697 are thin under a tight triage window (assuming CmdLine auditing). I’ll then grab the nearest 4624 LogonType 3 to tag the source — @jgreenwood22 do you pair those pivots?