Service changes are unexpected modifications to a system’s services, such as a new startup program, a changed daemon setting, an altered service account, or a disabled security service. In incident response, these changes matter because attackers often edit services to gain persistence, hide activity, or weaken defenses.
Defenders look for service changes during log review and system triage. A renamed Windows service, a Linux systemd unit that starts a strange binary, or a security tool that is suddenly stopped can indicate unauthorized access. Comparing current service state to a known-good baseline helps reveal tampering, even when other signs of compromise are subtle. In extortion cases, checking service changes can quickly show whether an intruder touched core systems or tried to disrupt operations.