CHFI OS and Network Forensics Practice Question
Which Windows Event ID is generated when a new service is installed on a system, and is often used by malware to establish persistence?
⚠ Common exam trap
The EC-CHFI exam often tests the distinction between Event IDs related to authentication (4624, 4648) and those related to system configuration changes (7045), so candidates may confuse logon events with service installation events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
7045
Event ID 7045 is generated by the Windows Service Control Manager (SCM) when a new service is installed on the system. Malware often uses this event to establish persistence by creating a service that automatically starts, and forensic analysts look for 7045 events to detect unauthorized service installations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
4624
Why it's wrong here
Event 4624 is a Security log event indicating a successful logon for an account and session. It is generated by the Local Security Authority (LSA) for every interactive, network, or service logon, and does not indicate that a new service was installed. Malware persistence via services does not itself produce 4624, and this event type provides no information about an executable being registered as a service.
- ✗
4648
Why it's wrong here
Event 4648 is a Security log event that records a logon attempt using explicit credentials, such as with the RunAs command or secondary logon service. It is logged when a user supplies alternate credentials to run a process, not when the process is installed as a service. While gaining elevated privileges may precede service creation, 4648 itself has no correlation with the Service Control Manager and cannot serve as the event ID for new service installation.
- ✓
7045
Why this is correct
Event 7045 is the correct event because it is the Service Control Manager (SCM) event logged in the System event log whenever a new service is installed on the system. This event captures critical persistence indicators, including the service name, image file path, service type, and start type, making it a primary focus for forensic analysts investigating malware that establishes persistence by registering itself as a service. Unlike the Security log events in the other options, 7045 directly maps to the act of creating a service and appears during both legitimate software installs and malicious service creation.
- ✗
4720
Why it's wrong here
Event 4720 is a Security log event that is generated when a new user account is created in Active Directory or on the local machine. It records attributes such as the new account's name, the security identifier (SID), and the caller who created it, but it has no relation to the Service Control Manager or the installation of services. Therefore, 4720 is unrelated to the scenario of a service being installed and cannot be used to detect new service persistence.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.