查询Windows事件ID 7045服务类型字段与4697服务类型标志的对应关系文档

Hey there! I’ve tackled this exact problem before when building detection rules for suspicious Windows services, so let me share the verified mappings I’ve put together—since official docs are surprisingly scattered on this direct cross-reference.

After cross-checking Windows API definitions, real event log samples, and community testing, here’s the one-to-one (and combined) mapping between Event 7045’s human-readable Service Type and Event 4697’s hex flags:

• "kernel mode driver" (Event 7045) ↔ 0x1 (Event 4697 Service Type flag)
• "file system driver" (Event 7045) ↔ 0x2 (Event 4697)
• "adapter driver" (Event 7045) ↔ 0x4 (Event 4697)
• "recognizer driver" (Event 7045) ↔ 0x8 (Event 4697)
• "own process" (Event 7045) ↔ 0x10 (Event 4697)
• "shared process" (Event 7045) ↔ 0x20 (Event 4697)
• "interactive process" (Event 7045) ↔ 0x100 (Event 4697)

A quick note: You might see combined Service Types in Event 7045 (like "own process, interactive process")—these map directly to the bitwise OR of the corresponding 4697 flags (in this case, 0x110 = 0x10 + 0x100).

While Microsoft hasn’t published a public doc that explicitly links these two event types’ Service Type fields, these mappings align perfectly with the SERVICE_TYPE enum used in Windows’ underlying service management APIs, so they’re reliable for detection use cases.

备注：内容来源于stack exchange，提问作者Jary Rym