Event ID 4697: A service was installed in the system
Written in the Security log when a new service is installed, with its file path and the account it runs as.
- Log
- Security
- Category
- Persistence
Why it matters
- Attackers install services to persist and to run code as SYSTEM; PsExec and many remote admin tools also create services.
- Service paths in user or temp folders, or containing PowerShell or cmd, are red flags.
What to check
Check Service Name, Service File Name, Service Start Type and Service Account.
How to turn it on
Advanced Audit Policy: System > Audit Security System Extension.
MITRE ATT&CK
- T1543.003 Windows Service
- T1569.002 Service Execution