// REFERENCE
7040 — Service start type changed
Log: System
Medium risk
A service's start type was changed (e.g. from "disabled" to "automatic", or vice-versa). Flipping a persistence service to automatic, or disabling security services (Windows Defender, event log), is evasion worth watching.
Related tools
Work with this in:
Related
7045
7045 — A service was installed 4697
4697 — A service was installed (Security) 4698
4698 — A scheduled task was created 4699
4699 — A scheduled task was deleted 4700
4700 — A scheduled task was enabled 4702
4702 — A scheduled task was updated
7045 — A service was installed 4697
4697 — A service was installed (Security) 4698
4698 — A scheduled task was created 4699
4699 — A scheduled task was deleted 4700
4700 — A scheduled task was enabled 4702
4702 — A scheduled task was updated
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.