Windows Security Event 4697: HybridConnectionManager Service Installation

Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published: 2021-04-12
Updated: 2026-07-31

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1554Compromise Host Software Binary
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies installation attempts of the Windows service named HybridConnectionManager by matching Security Event ID 4697 with the service name and executable filename containing HybridConnectionManager. Attackers may use service installation for persistence or to run attacker-controlled components as a Windows service. It relies on Security audit telemetry for service installation events (EventID 4697) that include service name and service file path details.

Reporting behind it

Related detections8 linkedT1554 — drag to rearrange

Malicious Backdoored liblzma XZ Utils Library File via file_event

Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

Windows TanStack Supply-Chain File Creation Indicators via router_init.js and router_runtime.js

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Linux setcap sets cap_setuid on a binary via setcap utility

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Windows Security Event 4697: HybridConnectionManager Service Installation

Pivot detection · T1554 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-installation-hybridconnectionmanager-event-id-4697-0ee4d8a5

title: "Windows Security Event 4697: HybridConnectionManager Service Installation"
id: 2f2dc11a-2e43-47e4-b90e-c13747890052
status: test
description: This rule identifies installation attempts of the Windows service named HybridConnectionManager by matching Security Event ID 4697 with the service name and executable filename containing HybridConnectionManager. Attackers may use service installation for persistence or to run attacker-controlled components as a Windows service. It relies on Security audit telemetry for service installation events (EventID 4697) that include service name and service file path details.
references:
  - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1554
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName: HybridConnectionManager
    ServiceFileName|contains: HybridConnectionManager
  condition: selection
falsepositives:
  - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high
license: DRL-1.1
related:
  - id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL