Windows Security Event 4697: HybridConnectionManager Service Installation
Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2021-04-12
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies installation attempts of the Windows service named HybridConnectionManager by matching Security Event ID 4697 with the service name and executable filename containing HybridConnectionManager. Attackers may use service installation for persistence or to run attacker-controlled components as a Windows service. It relies on Security audit telemetry for service installation events (EventID 4697) that include service name and service file path details.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 4697: HybridConnectionManager Service Installation"
id: 2f2dc11a-2e43-47e4-b90e-c13747890052
status: test
description: This rule identifies installation attempts of the Windows service named HybridConnectionManager by matching Security Event ID 4697 with the service name and executable filename containing HybridConnectionManager. Attackers may use service installation for persistence or to run attacker-controlled components as a Windows service. It relies on Security audit telemetry for service installation events (EventID 4697) that include service name and service file path details.
references:
- https://twitter.com/Cyb3rWard0g/status/1381642789369286662
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2021-04-12
modified: 2022-10-09
tags:
- attack.persistence
- attack.t1554
logsource:
product: windows
service: security
definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
selection:
EventID: 4697
ServiceName: HybridConnectionManager
ServiceFileName|contains: HybridConnectionManager
condition: selection
falsepositives:
- Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high
license: DRL-1.1
related:
- id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
type: derived