Services & Log Clearing (7045, 1102)

What is it?

7045 (System log) records a new service installed — a common persistence mechanism. 1102 (Security log) records that the Security log was CLEARED — an anti-forensics action.

Why it matters

A new service pointing at a user-path binary is persistence; a 1102 log-clear is an attacker covering tracks — and the clear event itself survives, so the gap and the 1102 are both findings.

Where you see it

7045 with a ServiceName and ImagePath; 1102 naming the account that cleared the log and the time — after which earlier Security events are gone.

What normal looks like

Services installed by known software during maintenance; log clears essentially never in normal operation.

What suspicious looks like

A 7045 for a service running a binary from C:\Users\Public, or any 1102 you did not perform — a cleared Security log is almost always malicious.

How analysts investigate

Check 7045 ImagePaths against expected locations, and treat any 1102 as a high-priority anti-forensics event: who cleared it, when, and what timeframe of evidence is now missing.

Common beginner mistakes

Overlooking a 7045 service with a suspicious ImagePath.
Not treating a 1102 log-clear as a serious anti-forensics indicator.

Persistence and cover-up

  7045  System  ServiceName 'WinHelperSvc'  ImagePath C:\Users\Public\svc.exe
     → a service running a Public-path binary = persistence
  1102  Security  'The audit log was cleared'  by svc-helper  02:30
     → anti-forensics; events before 02:30 may be gone (the clear survives)

7045 exposes service persistence; 1102 is a log-clear the attacker cannot hide (the clear itself is logged).

Quick check

You find a 1102 'audit log was cleared' that no admin performed. Priority?

A quick self-check — it doesn't affect your XP or progress.