huntrule

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Connor Martin, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-12-23
Updated
2026-07-31
AnalysisDetection
title: Windows Security Event 4697 Service Install of Remote Access Tools
id: 058cbf1a-8eb6-430a-a92f-8baefab41dca
related:
  - id: 1a31b18a-f00c-4061-9900-f735b96c99fc
    type: similar
  - id: c8b00925-926c-47e3-beea-298fd563728e
    type: derived
status: test
description: This rule flags Windows service creation events (Security EventID 4697) where the installed service name contains common remote access tool identifiers. Attackers often abuse remote access software to establish persistent remote control and facilitate execution after initial access. It relies on Windows Security auditing telemetry that records service installation details, specifically EventID 4697 and the service name.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_install_remote_access_software.yml
author: Connor Martin, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2024-12-07
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName|contains:
      - AmmyyAdmin
      - AnyDesk
      - Atera
      - BASupportExpressSrvcUpdater
      - BASupportExpressStandaloneService
      - chromoting
      - GoToAssist
      - GoToMyPC
      - jumpcloud
      - LMIGuardianSvc
      - LogMeIn
      - monblanking
      - Parsec
      - RManService
      - RPCPerformanceService
      - RPCService
      - SplashtopRemoteService
      - SSUService
      - TeamViewer
      - TightVNC
      - vncserver
      - Zoho
  condition: selection
falsepositives:
  - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out
level: medium
license: DRL-1.1