Home / Stories / Topic

System Services

Topic • 1 Story

Dikshant Lather · Sep 25, 2026

Uncovering Malicious Windows Service Installation via Event ID 7045 and Defender KQL

Catch lateral movement and persistence tools (PsExec, Cobalt Strike PsExec service) by monitoring new Windows Service installations with KQL.

Threat Hunting 2 min read

0 0