4697 Security log · System Security high severity low volume

Windows Event ID 4697 — A service was installed in the system

New service installed in SCM database. ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount are key.

Why event 4697 matters

Service persistence (T1543.003). PsExec installs a service on the remote host. Ransomware installs as a service. Key indicators: ServiceFileName in temp/user paths. ServiceAccount=LocalSystem for a user-installed service.

How to detect it

Alert: ServiceFileName in %TEMP%, %APPDATA%, C:\Users\, or UNC paths. Alert: service installed by non-SYSTEM. Correlate with System log 7045 which also captures service installs.

Log source
Security
Advanced Audit Policy — enable the 'System Security' subcategory (Success and/or Failure).
Fields to pivot on
ServiceNameServiceFileNameServiceTypeServiceStartType

MITRE ATT&CK mapping

Tactic Technique
Persistence Windows Service (T1543.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Service Installation
status: stable
description: Service installed from suspicious path
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4697
    filter_legit:
        ServiceFileName|startswith:
            - 'C:\\Windows\\'
            - 'C:\\Program Files\\'
            - 'C:\\Program Files (x86)\\'
    condition: selection and not filter_legit
falsepositives:
    - Software installers
    - IT management agents
level: high
tags:
    - attack.persistence
    - attack.t1543.003
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4697   // A service was installed in the system
| project TimeGenerated, Computer, ServiceName, ServiceFileName, ServiceType, ServiceStartType
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4697
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A service was installed in the system — add EventData fields: ServiceName, ServiceFileName, ServiceType, ServiceStartType`
Hunt event 4697 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Windows Event ID 4697?

A service was installed in the system. New service installed in SCM database. ServiceName, ServiceFileName, ServiceType, ServiceStartType, ServiceAccount are key.

Which log records event 4697?

Event 4697 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System Security' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4697?

Event 4697 is associated with: Windows Service (T1543.003).

How do you detect activity around event 4697?

Alert: ServiceFileName in %TEMP%, %APPDATA%, C:\Users\, or UNC paths. Alert: service installed by non-SYSTEM. Correlate with System log 7045 which also captures service installs.