Struct ServiceEntry 

pub struct ServiceEntry {
    pub name: String,
    pub display_name: String,
    pub image_path: String,
    pub service_dll: Option<String>,
    pub failure_command: Option<String>,
    pub start_type: u32,
    pub service_type: u32,
    pub object_name: String,
    pub description: String,
    pub is_suspicious: bool,
    pub suspicious_reason: Option<String>,
    pub last_written: Option<DateTime<Utc>>,
}

A single service entry extracted from the SYSTEM registry hive.

Fields

name: String

Subkey name (the internal service name, e.g. "Dnscache").

display_name: String

Human-readable display name (DisplayName value).

image_path: String

Path to the service binary (ImagePath value).

service_dll: Option<String>

The DLL a shared-process / svchost-hosted service loads, read from Parameters\ServiceDll. None when the service hosts no DLL. Kept raw (REG_EXPAND_SZ env vars like %SystemRoot% are NOT pre-expanded), matching how image_path is handled. This is the actual code a svchost-hosted service runs — and a common persistence vector (T1543.003).

failure_command: Option<String>

A recovery-action command line (FailureCommand value) run when the service fails — abused for persistence. None when absent.

start_type: u32

Numeric start type: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled.

service_type: u32

Numeric service type: 1=KernelDriver, 2=FsDriver, 16=OwnProcess, 32=ShareProcess.

object_name: String

Account the service runs as (ObjectName value), e.g. "LocalSystem".

description: String

Service description (Description value); empty string when absent.

is_suspicious: bool

true when the service matches one or more anomaly patterns.

suspicious_reason: Option<String>

Human-readable explanation when is_suspicious is true.

last_written: Option<DateTime<Utc>>

The service key’s LastWriteTime — approximately the service install/modify time. None when the key carries no timestamp.

Trait Implementations

impl Clone for ServiceEntry

fn clone(&self) -> ServiceEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for ServiceEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.