Microsoft.Windows.ServiceControlManager

Title	Sample	Rule
ServiceConfigChange	Y	N
ServiceStarted	Y	N
ServiceDeleted	Y	N
ServiceStateChange	Y	N
ServiceHostStarted	Y	N

ServiceConfigChange

Level: 4

Fields #

Name	Description
`NewStartType`
`Operation`
`ServiceName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1084,
      "thread_id": 3744
    },
    "guid": "B8DDCEA7-B520-4909-BCEB-E0170C9F0E99",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.ServiceControlManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:46:48.454Z",
    "version": 0
  },
  "event_data": {
    "NewStartType": 3,
    "Operation": "StartType",
    "ServiceName": "dwh-s1"
  },
  "message": ""
}

ServiceStarted

Level: 4

Fields #

Name	Description
`IsCritical`
`IsOwnProcess`
`IsUserService`
`LoadOrderGroup`
`PID`
`ServiceName`
`StartReason`
`SvchostGroup`
`TriggerType`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1084,
      "thread_id": 3744
    },
    "guid": "B8DDCEA7-B520-4909-BCEB-E0170C9F0E99",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.ServiceControlManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:22.433Z",
    "version": 0
  },
  "event_data": {
    "IsCritical": false,
    "IsOwnProcess": true,
    "IsUserService": false,
    "LoadOrderGroup": "None",
    "PID": 12976,
    "ServiceName": "wuauserv",
    "StartReason": 1,
    "SvchostGroup": "None",
    "TriggerType": 0
  },
  "message": ""
}

ServiceDeleted

Level: 4

Fields #

Name	Description
`ServiceName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1084,
      "thread_id": 7440
    },
    "guid": "B8DDCEA7-B520-4909-BCEB-E0170C9F0E99",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.ServiceControlManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:40:41.831Z",
    "version": 0
  },
  "event_data": {
    "ServiceName": "dwh-tls1"
  },
  "message": ""
}

ServiceStateChange

Level: 4

Fields #

Name	Description
`DurationInMs`
`NewState`
`OldState`
`ServiceName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1084,
      "thread_id": 7440
    },
    "guid": "B8DDCEA7-B520-4909-BCEB-E0170C9F0E99",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.ServiceControlManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:40:41.515Z",
    "version": 0
  },
  "event_data": {
    "DurationInMs": 31,
    "NewState": 1,
    "OldState": 2,
    "ServiceName": "dwh-tls1"
  },
  "message": ""
}

ServiceHostStarted

Level: 4

Fields #

Name	Description
`PID`
`ServiceHostName`

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1084,
      "thread_id": 3744
    },
    "guid": "B8DDCEA7-B520-4909-BCEB-E0170C9F0E99",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.ServiceControlManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:22.431Z",
    "version": 0
  },
  "event_data": {
    "PID": 12976,
    "ServiceHostName": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p"
  },
  "message": ""
}