huntrule

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Connor Martin, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-12-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows service creation events (Security EventID 4697) where the installed service name contains common remote access tool identifiers. Attackers often abuse remote access software to establish persistent remote control and facilitate execution after initial access. It relies on Windows Security auditing telemetry that records service installation details, specifically EventID 4697 and the service name.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)
Windows Service Control Manager detects Sliver C2 default service installations via service creation events
Windows Registry Service Install Indicators for Cobalt Strike Staging
Windows Service Control Manager: ProcessHacker service runs as LocalSystem
Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike
Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads
Windows Service Creation: ServiceName javamtsup (Event ID 4697)
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Malicious TinyTurla ServiceDll Registration via svchost Group (via registry_set)
Windows Security Event 4697 Service Install of Remote Access Tools
Pivot detection · T1543.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.