# Services

File Location:

* C:\Windows\config\SYSTEM

Service Registry Location:

* HKLM\SYSTEM\CurrentControlSet\Services

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FFYw6SuuJRjytepsV0gVX%2Fimage.png?alt=media&#x26;token=73bf96d2-ffc6-4211-a616-9c6e63d8f173" alt=""><figcaption></figcaption></figure>

### Parse Data

### Considerations

### Audit Logs

System.evtx

* 7034: Service crashed unexpectedly
* 7035: Service sent a Start/Stop control
* 7040: Service started or stopped
* 7045: A new service was installed on the system (Win2008R2+).

Security.evtx

* 4697: A new service was installed on the system (Security log).

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FbhLU4hI0sTuNFPusPRzC%2Fimage.png?alt=media&#x26;token=f528cda6-c156-43c8-ba6a-fd22f10cbea8" alt=""><figcaption></figcaption></figure>

### Remote Artifacts

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FQIzoZfQfBJCwxlBvUgWN%2Fimage.png?alt=media&#x26;token=03d04bba-53d9-4768-abab-1805e0e2341c" alt=""><figcaption></figcaption></figure>

### Anti-Forensics

Hiding Services:

{% embed url="<https://www.sans.org/blog/red-team-tactics-hiding-windows-services/>" %}

{% embed url="<https://www.sans.org/blog/defense-spotlight-finding-hidden-windows-services/>" %}
