Exam 312-49v10 topic 1 question 687 discussion

The forensic analyst should look for the following event IDs in the System log to confirm suspicious behavior related to a service frequently starting and stopping: A. Event ID 7035 and Event ID 7036 Event ID 7035: This event ID indicates that a service control manager has requested a service to start or stop. Event ID 7036: This event ID indicates that a service has changed its state (started, stopped, etc.). These events are crucial for tracking the status changes of services on a Windows system and can help identify unusual or suspicious behavior.

Event ID 7035: This event ID indicates that the service control manager has sent a start or stop control to a service. Event ID 7036: This event ID indicates that a service has entered a state, such as running or stopped. revealed to me in a vision.

A > For an example if host A had his service state changed from running to stopped then it will generate an event id 7035/7036 on the windows event log on the Windows Server.