Windows Security EID 4697 Service Execution of Credential Dumping Tools
Alerts on Event ID 4697 service execution paths containing common credential dumping tool names on Windows.
- Product
- windows
- Service
- security
- Author
- Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2017-03-05
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security audit events (EventID 4697) where a service is created and the service binary path/name contains well-known credential dumping tool indicators such as cachedump, dumpsvc, fgexec, gsecdump, mimidrv, pwdump, or servpw. Credential dumping is a common attacker objective for accessing credentials and escalating privileges. The detection relies on Security log telemetry for service creation events that include the referenced service file name.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security EID 4697 Service Execution of Credential Dumping Tools
id: f243bc7a-fff3-4d94-980f-8ae492573f54
related:
- id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
type: derived
- id: f0d1feba-4344-4ca9-8121-a6c97bd6df52
type: derived
status: test
description: This rule flags Windows Security audit events (EventID 4697) where a service is created and the service binary path/name contains well-known credential dumping tool indicators such as cachedump, dumpsvc, fgexec, gsecdump, mimidrv, pwdump, or servpw. Credential dumping is a common attacker objective for accessing credentials and escalating privileges. The detection relies on Security log telemetry for service creation events that include the referenced service file name.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_mal_creddumper.yml
author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2017-03-05
modified: 2022-11-29
tags:
- attack.credential-access
- attack.execution
- attack.t1003.001
- attack.t1003.002
- attack.t1003.004
- attack.t1003.005
- attack.t1003.006
- attack.t1569.002
- attack.s0005
logsource:
product: windows
service: security
definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
selection:
EventID: 4697
ServiceFileName|contains:
- cachedump
- dumpsvc
- fgexec
- gsecdump
- mimidrv
- pwdump
- servpw
condition: selection
falsepositives:
- Legitimate Administrator using credential dumping tool for password recovery
level: high
license: DRL-1.1