Log Dejargonizer

Windows Security Log · Event 4697

Event 4697: A service was installed in the system

A new Windows service was registered. Services start automatically and run with high privilege, which is why installing one is a standard way to keep access to a machine. Most are ordinary software; the ones that are not stand out quickly.

Also written as 4697Event ID 4697

What it means for you

On a personal computer

A program installed a background component that starts with Windows. Normal when you have just installed software; worth questioning if you have not.

For an analyst

The service file name is the field that matters. Legitimate services live in Program Files or System32; services pointing at temp directories, user profiles, or a command interpreter with arguments are the classic remote-execution and persistence patterns. Note this event needs the Audit Security System Extension subcategory enabled, and System log event 7045 covers similar ground without it.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A service was installed in the system.

Subject:
  Security ID:    CORP\jbrooks-adm
  Account Name:   jbrooks-adm
  Account Domain: CORP
  Logon ID:       0x3E9A11

Service Information:
  Service Name:      WinHelpSvc
  Service File Name: C:\Users\jbrooks\AppData\Local\Temp\wh.exe
  Service Type:      0x10
  Service Start Type: 2
  Service Account:   LocalSystem

The fields that decide it

Everything else in the log line is context.

ServiceName
The name the service registered under. Names imitating Windows components are a common disguise.
ServiceFileName
The command line the service runs. This is the field to read first.
  • A path under Program Files or System32Where legitimate services live.
  • A path under a temp or user profile directoryServices do not normally live here.
  • cmd.exe or powershell.exe with argumentsRemote execution tooling frequently registers a service that simply runs a command.
  • A path with an unquoted spaceAn unquoted service path, which is a privilege-escalation weakness regardless of intent.
ServiceType
What kind of service was registered. Kernel driver types deserve more scrutiny than user-mode services.
ServiceStartType
When it starts. Automatic means it survives a reboot, which is the point of persistence.
ServiceAccount
The account it runs as. LocalSystem is full privilege.
SubjectUserName
Who installed it.

Ordinary reasons this happens

Most of the time it is one of these.

  • Installing ordinary software — most non-trivial applications register at least one service.
  • Windows updates and driver installations.
  • Management, backup, and security agents being deployed.
  • Virtualisation and container tooling registering supporting services.
  • A machine build installing its standard software set.

When it is not ordinary

Persistence through an automatically starting service.

What gives it awayA service pointing at a binary outside normal software directories, with an automatic start type.

ATT&CK T1543.003

Remote command execution across the network.

What gives it awayA short-lived service whose file name is a command interpreter with arguments. This is how several remote-administration tools work, legitimate ones included.

ATT&CK T1569.002

Loading a driver to interfere with security tooling.

What gives it awayA kernel driver service type registered outside a driver installation.

ATT&CK T1547.006

A service named to imitate a Windows component.

What gives it awayA service name resembling a built-in one but with a path that does not match where the real component lives.

ATT&CK T1036.005

What to do next

  1. Read ServiceFileName first. The path answers most of the question by itself.
  2. Check whether a software installation was happening on that machine at that time.
  3. Compare the service name against the built-in services on a known-good machine.
  4. Check how widely the same service appears across the estate. Present everywhere means it is your tooling.
  5. If the service runs a command interpreter, treat it as remote execution and find the source.
  6. Look at what the service account is and whether a matching 4688 shows the service actually starting.

Queries to run

kql 
SecurityEvent | where EventID == 4697 | project TimeGenerated, Computer, ServiceName, ServiceFileName, ServiceAccount, InstalledBy = SubjectUserName | order by TimeGenerated desc
kql Services running from unusual locations or executing a shell. This is a short list and worth reading in full. 
SecurityEvent | where EventID == 4697 | where ServiceFileName has_any ('\\Temp\\','\\Users\\','cmd.exe','powershell.exe','%COMSPEC%') | project TimeGenerated, Computer, ServiceName, ServiceFileName
splunk Rarest services first. Anything appearing on one machine out of a thousand deserves a look. 
index=wineventlog EventCode=4697 | stats count values(dest) as hosts by Service_Name Service_File_Name | sort count asc

Common questions

What is the difference between Event 4697 and Event 7045?

They record the same thing from different logs. 7045 is written to the System log by the Service Control Manager and is available by default. 4697 is written to the Security log and requires the Audit Security System Extension subcategory to be enabled, but it is the better one to collect because it also records which account performed the installation.

How can I tell if a newly installed service is malicious?

Read the service file name. Legitimate services run binaries from Program Files, System32, or a vendor's own directory. A service pointing at a temp folder, a user profile directory, or a command interpreter with arguments is not a normal software installation, regardless of what the service calls itself.

Why do attackers install Windows services?

Because a service starts automatically at boot, runs with high privilege, and needs no one to be signed in. That combination makes it durable access, which is why service installation is one of the most consistently useful persistence signals to monitor.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026