SOC Event Lookup
Event ID 4697ServiceP1

Windows Event ID 4697: A service was installed in the system

Applicable version
Windows Server 2016 and later; Windows 10 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4697 records installation of a service and is a high-value signal for persistence and remote execution.

Technical Metadata

Technical metadata for Event ID 4697
Event ID4697
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1543.003 Create or Modify System Process: Windows Service
Key fields to watchService Name, Service File Name, Subject

Trigger Scenarios

The event is generated when a new service is installed and Security System Extension auditing is enabled.

Key Fields

Service Name

The installed service identifier. Names that imitate legitimate services require careful validation.

Service File Name

The binary path and arguments used by the service. Writable paths, UNC paths, and suspicious command lines are important indicators.

Subject

The account that installed the service. Correlate it with remote logon and process telemetry.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4697
SecurityEvent
| where EventID == 4697
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4697
index=wineventlog source="WinEventLog:Security" EventCode=4697
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4697
dataset = microsoft_windows_raw
| filter edr_event_id = 4697
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4697
title: Windows Event ID 4697
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4697
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
ServiceStartType2The service is configured for automatic start by the service control manager during startup.An unknown executable with start type 2 establishes reboot persistence and deserves immediate path and signer review. Source
ServiceStartType0The service is a boot-start device driver loaded by the system loader.An unexpected driver service at boot start has kernel-level impact and requires validation of the image and signature. Source

MITRE ATT&CK Mapping

  • T1543.003Create or Modify System Process: Windows Service

Detection Notes

T1543.003 Windows Service persistence is indicated when Service File Name points to a user-writable path, UNC path, or contains powershell.exe/cmd.exe, and Service Start Type is Auto start or Boot start. A service created after Type 3 SMB access is consistent with remote service execution.

Common False Positives

  • Software installation, patching, EDR, and management systems routinely install services.
  • Administrators may install services during maintenance windows.

Related Events

Sample Log

Sanitized event sample
Service Name: UpdaterSvc
Service File Name: C:\Users\Public\updater.exe
Service Start Type: Auto start
Subject: CORP\admin.ops

Frequently Asked Questions

What does Windows Event ID 4697 mean?

Event ID 4697 records installation of a Windows service and includes its name, image path, service type, start type, and service account.

Which 4697 fields are most important for detection?

ServiceFileName, ServiceStartType, ServiceType, ServiceAccount, SubjectUserName, and the host determine what will run, when it starts, and who installed it.

Are all new service events malicious?

No. Software installation and enterprise management routinely create services; suspicious cases involve unapproved installers, user-writable or remote paths, command interpreters, unusual accounts, or unexpected boot and automatic start types.

Sources