Windows Service Start/Stop Event IDs for Forensics
A large corporation has recently undergone a cyberattack. The forensic analyst finds suspicious activities in the Windows Event logs during the investigation. The analyst notes that a specific service on the machine has been frequently starting and stopping during the time of the attack. What event IDs should the analyst look for in the System log to confirm this suspicious behavior?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests knowledge of Windows Service Control Manager logs; the trap is confusing control requests with state notifications or system audit events.
Identify the specific Windows System log Event IDs (7035 and 7036) that track service state changes to detect suspicious start/stop activity during a forensic investigation. This page establishes why these logs are critical for timeline reconstruction.
Selecting Event ID 1, which is a generic system boot event, instead of the specific service lifecycle events required to trace individual service behavior.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A because Event ID 7035 and Event ID 7036 are the primary indicators of service state transitions in the Windows System log. Event ID 7035 is generated when the Service Control Manager sends a start or stop control to a service, effectively logging the command issued. Event ID 7036 indicates that a service has entered a new state (such as 'running' or 'stopped'), confirming the outcome of that action. Together, they provide a complete picture of a service being started and stopped.Why the Other Options Are Wrong
Option B includes Event ID 1, which is a general system startup/shutdown event and does not specifically identify individual service actions. Option C lists Event IDs 7031 and 7032, which relate to services terminating unexpectedly or failing to start, rather than normal or suspicious controlled starts/stops. Option D pairs 7036 with 7037; while 7036 is correct, 7037 logs service failure details, making it less relevant for tracking simple start/stop cycles compared to the control request (7035).Community Comment Notes
Community members generally agree on the pair of 7035 and 7036. As user jingu_bingo noted, "Event ID 7035: This event ID indicates that the service control manager has sent a start or stop control to a service," highlighting the distinction between the command and the state change. Another commenter confirmed that these events appear when a host's service state changes from running to stopped, validating their use in detecting such activity.Exam Strategy
Focus on memorizing the core Windows Security and System log Event IDs. Specifically, distinguish between 'control' events (commands sent) and 'state' events (outcomes achieved) to accurately reconstruct attacker actions.
Frequently Asked Questions
What is the difference between Event ID 7035 and 7036?
7035 logs the command sent by the Service Control Manager to start/stop a service, while 7036 logs the resulting state change of the service.
Why is Event ID 1 not used for service tracking?
Event ID 1 is a generic system startup/shutdown event. It does not provide granular details about individual services starting or stopping.