services

Lists all installed Windows services and their relevant data.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: services

  • Windows

Table schema

Name

Type

Description

name

TEXT

Service name

service_type

TEXT

Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)

display_name

TEXT

Service Display name

status

TEXT

Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED

pid

INTEGER

the Process ID of the service

start_type

TEXT

Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED

win32_exit_code

INTEGER

The error code that the service uses to report an error that occurs when it is starting or stopping

service_exit_code

INTEGER

The service-specific error code that the service returns when an error occurs while the service is starting or stopping

path

TEXT

Path to Service Executable

module_path

TEXT

Path to ServiceDll

description

TEXT

Service Description

user_account

TEXT

The name of the account that the service process will be logged on as when it runs. This name can be of the form DomainUserName. If the account belongs to the built-in domain, the name can be of the form .UserName.

Query examples

select * from services