First Time Seen Running Windows Service

The analytic detects the first occurrence of a Windows service running in the environment by leveraging Windows system event logs (EventCode 7036) to identify services entering the "running" state. The appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software, potentially allowing an attacker to execute arbitrary code, maintain persistence, or escalate privileges. Monitoring for new services aids in early detection of potential threats.