Event ID 4697: service installed
What Event ID 4697 (service installed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4697 is the Security log's record of a new service. System Event ID 7045 records the same thing and is always on; 4697 appears only when the "Audit Security System Extension" subcategory is enabled, but it adds who installed the service and lands in the log your SIEM probably already collects. Remote execution tools such as PsExec, Impacket and Cobalt Strike all work by installing a service, so this is one of the most reliable lateral movement signals Windows gives you.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject > Account Name | Who installed the service. A user account here, rather than SYSTEM or an installer, deserves a look. |
| Service Name | The name it was registered under. PSEXESVC is PsExec; random strings of 7 or 8 letters are typical of attack frameworks. |
| Service File Name | What the service runs. This is the field that decides most cases. |
| Service Start Type | 2 is automatic (persistence), 3 is on demand (often run once and deleted). |
| Service Account | Usually LocalSystem, which is exactly why attackers like services. |
What is normal
Software installers, Windows updates, driver installs and management agents. They run from Program Files or System32, have readable names and turn up during patch windows.
When Event ID 4697 is suspicious
- Service File Name containing
cmd /c,powershell,-enc,rundll32ormshta: the service is a launcher, not a program. - A binary in
C:\Windows\Temp,C:\Users\...,ProgramDataor\\127.0.0.1\ADMIN$\. %COMSPEC% /Q /c echo ...redirected to a file on ADMIN$, the pattern Impacket's smbexec leaves.- The same service name appearing on many hosts within minutes, installed by one account.
- A service installed and then removed again a few seconds later.
Common false positive: IT teams use PsExec and RMM tools for legitimate work. Check the account and whether a ticket exists before escalating, and keep a list of the tools your admins actually use.
Find Event ID 4697 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4697
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- System Event ID 7045: New service installed
- Event ID 4624: Successful logon
- Event ID 5145: Share object access check
- Event ID 4688: New process created
FAQ
What is the difference between Event ID 4697 and 7045?
Both record a new service. 7045 is in the System log and is written by default; 4697 is in the Security log, needs an audit subcategory turned on, and includes the account that installed it. Collect both if you can.
How do I enable Event ID 4697?
Advanced Audit Policy > System > Audit Security System Extension, Success. In a GPO that is under Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.