service.yaml

---
name: Service
description: Services, or a service application, can be started automatically at system boot, by a user through the services control panel applet, or by an application that uses service functions. Services can execute even when no user is logged into the system.
actions:
  - name: create
    description: The event corresponding to the act of creating a new service.
  - name: delete
    description: The event corresponding to the act of deleting a service.
  - name: pause
    description: The event corresponding to the act of pausing a currently running service.
  - name: start
    description: The event corresponding to the act of starting a new service.
  - name: stop
    description: The event corresponding to the act of stopping a service that is currently running.
fields:
  - name: fqdn
    description: The fully qualified domain name of the host. Contains the hostname appended with the domain.
    example: HOST1.EXAMPLE_DOMAIN.COM
  - name: hostname
    description: The hostname of the host, without the domain.
    example: HOST1
  - name: user
    description: The user token that service was created with.
    example: HOST1\LOCALUSER
  - name: command_line
    description: The command line that service is started with.
    example: C:\windows\system32\svchost.exe -k rpcss
  - name: exe
    description: The executable for the service.
    example: svchost.exe
  - name: image_path
    description: Where in the file system the service executable is located.
    example: C:\path\to\example.exe
  - name: name
    description: The name of the service.
    example: RpcSs
  - name: pid
    description: The process ID for the process of the service, represented in decimal notation.
    example: 718
  - name: ppid
    description: The process ID of the process’s parent or the service, represented in decimal notation. In the parent process, this will be the pid field.
    example: 1860
  - name: uid
    description: The ID of SID of the user who acted on the service
    example: S-1-5-18
coverage_map:
  create:
    command_line: ["autoruns_13.98"]
    exe: ["autoruns_13.98"]
    fqdn: ["autoruns_13.98"]
    hostname: ["autoruns_13.98"]
    image_path: ["autoruns_13.98"]
  delete:
    command_line: ["autoruns_13.98"]
    exe: ["autoruns_13.98"]
    fqdn: ["autoruns_13.98"]
    hostname: ["autoruns_13.98"]
    image_path: ["autoruns_13.98"]