Windows PowerShell Script Installed as a Service (Event ID 4697)

title: Windows PowerShell Script Installed as a Service (Event ID 4697)
id: 6bd55e67-0359-4a1b-92cb-6e76dabcc3fe
related:
  - id: a2e5019d-a658-4c6a-92bf-7197b54e2cae
    type: derived
  - id: 2a926e6a-4b81-4011-8a96-e36cc8c04302
    type: derived
status: test
description: This rule flags Windows service installations (Security Event ID 4697) where the registered service executable name contains "powershell" or "pwsh". Attackers may use service creation to persist malicious PowerShell execution with high reliability. The detection relies on Windows Security auditing that records Event ID 4697 and the service file name field within that event.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_powershell_script_installed_as_service.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2022-11-29
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains:
      - powershell
      - pwsh
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1