Windows Service Installation of Remote Access Tools (Event ID 4697)

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

FreeUnreviewedSigmamediumv1

windows-service-installation-of-remote-access-tools-event-id-4697-c8b00925

title: Windows Service Installation of Remote Access Tools (Event ID 4697)
id: 058cbf1a-8eb6-430a-a92f-8baefab41dca
related:
  - id: 1a31b18a-f00c-4061-9900-f735b96c99fc
    type: similar
  - id: c8b00925-926c-47e3-beea-298fd563728e
    type: derived
status: test
description: This rule flags Windows Security event 4697 when a new service is installed and the service name contains indicators for multiple remote access tools. Attackers commonly use remote access utilities to maintain access and execute follow-on actions with persistence via Windows services. It relies on Windows Security auditing telemetry for service installation events (EID 4697) and matches on the resulting service name.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_install_remote_access_software.yml
author: Connor Martin, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2024-12-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName|contains:
      - AmmyyAdmin
      - AnyDesk
      - Atera
      - BASupportExpressSrvcUpdater
      - BASupportExpressStandaloneService
      - chromoting
      - GoToAssist
      - GoToMyPC
      - jumpcloud
      - LMIGuardianSvc
      - LogMeIn
      - monblanking
      - Parsec
      - RManService
      - RPCPerformanceService
      - RPCService
      - SplashtopRemoteService
      - SSUService
      - TeamViewer
      - TightVNC
      - vncserver
      - Zoho
  condition: selection
falsepositives:
  - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Security event 4697 when a new service is installed and the service name contains indicators for multiple remote access tools. Attackers commonly use remote access utilities to maintain access and execute follow-on actions with persistence via Windows services. It relies on Windows Security auditing telemetry for service installation events (EID 4697) and matches on the resulting service name.

Known false positives

The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.