Windows Service Installation via Unusual Client (ClientProcessId or ParentProcessId is 0)

title: Windows Service Installation via Unusual Client (ClientProcessId or ParentProcessId is 0)
id: 42e83254-1cfa-4d6e-9c16-3216cefaf6d0
related:
  - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
    type: similar
  - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
    type: derived
status: test
description: This rule flags Windows Security event 4697 when a service is installed and the initiating client process or its parent has a PID value of 0. Such values are atypical and can indicate abnormal or non-standard service installation behavior. The detection relies on Security audit telemetry for service installation events (EID 4697) and the associated ClientProcessId and ParentProcessId fields.
references:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
  - https://www.x86matthew.com/view_post?id=create_svc_rpc
  - https://twitter.com/SBousseaden/status/1490608838701166596
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-15
modified: 2023-01-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  service: security
  product: windows
  definition: "Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"
detection:
  selection_eid:
    EventID: 4697
  selection_pid:
    - ClientProcessId: 0
    - ParentProcessId: 0
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1