EventPeeker
Scan your Security and Sysmon logs·Detection guides
Event ID 4697Audit SuccessSecurityT1543.003

Windows Event ID 4697 — Service Installed in Service Control Manager

Logged in the Security log when a new service is installed in the Service Control Manager. Complements System log Event ID 7045 — both events fire for the same service installation but are written to different logs and captured by different audit policies. 4697 requires 'Audit Security System Extension' to be enabled; 7045 requires System log auditing.

MITRE ATT&CK

Technique

T1543.003 · Windows Service

Tactic

Persistence

View on attack.mitre.org →

Why It Matters

Services are one of the most durable persistence mechanisms on Windows — they survive reboots, run as SYSTEM or high-privilege accounts by default, and can be configured to restart automatically on failure. Attackers and post-exploitation frameworks (Metasploit, Impacket's psexec.py, Cobalt Strike) install services to execute payloads, establish C2 communication, and maintain access. PsExec creates a service named PSEXESVC to execute remote commands. Metasploit's psexec module generates random 4-character service names. Legitimate service installations from enterprise software always have known paths under Program Files or Windows — anything in Temp, AppData, ProgramData, or a user home directory is almost certainly malicious.

Key Fields

Service NameThe internal SCM name — random strings (4–8 random characters = Metasploit/psexec.py pattern), names mimicking Windows services (WindowsUpdate, WinDefend2, Spooler_svc), or PSEXESVC (PsExec remote execution) are suspicious
Service File NameThe full command line for the service binary — the most important field. Legitimate services run from C:\Windows\ or C:\Program Files\. Red flags: C:\Windows\Temp\, C:\Users\, AppData\, ProgramData\, UNC paths (\\attacker\share\payload.exe), cmd.exe /c or powershell.exe -enc embedded as the service command
Service TypeThe service type — 0x10 = own process (standard executable); 0x20 = shared process; 0x110 = interactive own process (deprecated, unusual). Kernel driver services (0x1, 0x2) from unexpected sources indicate rootkit installation
Service Start Type0x2 = Auto (starts at boot — high persistence); 0x3 = Manual; 0x4 = Disabled. Attackers prefer Auto for maximum persistence
Subject Account NameWho installed the service — SYSTEM, a known deployment account, or an IT management tool are expected. A standard user account, a service account not involved in software deployment, or an unexpected domain account is suspicious

Investigation Tips

  1. 1.Path is the fastest triage signal: legitimate enterprise services run from C:\Windows\, C:\Program Files\, or C:\Program Files (x86)\. Any 4697 with a Service File Name pointing to C:\Windows\Temp\, C:\Users\, AppData\, or a network UNC path is almost certainly malicious — escalate immediately.
  2. 2.PsExec pattern: Service Name = PSEXESVC, Service File Name = C:\Windows\PSEXESVC.exe. This is PsExec's remote execution mechanism — legitimate admin use is possible, but unexpected occurrences (especially from non-admin workstations or at unusual hours) should be investigated.
  3. 3.Metasploit/psexec.py pattern: random 4-8 character Service Name (e.g. XkBp, mnOQ), Service File Name often pointing to a UNC path or Temp directory, short-lived (service created, used, deleted within seconds). Alert on any service with a random-looking name.
  4. 4.Command-embedded services: Service File Name containing cmd.exe /c, powershell.exe -EncodedCommand, or wscript.exe indicates the 'service' is actually a command execution wrapper — the attacker is running a command disguised as a service.
  5. 5.Correlate with 4688: the process that called CreateService() to install the service will appear in 4688 events shortly before the 4697. This shows the attack chain — what executed to install the service.
  6. 6.Service Start Type 0x2 (Auto-start) in a suspicious path = durable persistence that survives reboots. Treat this as a critical finding requiring immediate isolation of the affected host.

Seeing Event ID 4697 in your own logs? Upload an .evtx file — EventPeeker flags service installed in service control manager automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.

Analyze my logs →

Related Event IDs

7045New service installed — System log equivalent; check both logs as audit policies differ
4688Process creation — the process that called CreateService() to install this service
4624Logon event — correlate Subject Logon ID to establish who installed the service and from where
1102Audit log cleared — attackers often clear logs after installing a service for persistence

Have Event ID 4697 open in Event Viewer?

In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.

No account. Your event data never leaves your browser.

Go deeper: the full Malicious Service Installation — Persistence via Windows Services guide

Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.

Read the Malicious Service Installation — Persistence via Windows Services guide →

See Event ID 4697 in your logs

Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects service installed in service control manager patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.

Analyze EVTX Logs Free →
← All detection guides·Analyze EVTX Logs Free →