Windows Service Created by Client With PID 0 or Parent PID 0
Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.
- Product
- windows
- Service
- security
- Author
- Tim Rauch (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-15
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows service creation events (Security Event ID 4697) where the creating client process ID is 0 or the parent process ID is 0. Attackers may use anomalous service installation patterns to establish persistence while reducing traceability. The detection relies on Windows Security audit telemetry for EventID 4697 and the ClientProcessId/ParentProcessId fields contained in that event.
Reporting behind it
- elastic.cohttps://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
- x86matthew.comhttps://www.x86matthew.com/view_post?id=create_svc_rpc
- twitter.comhttps://twitter.com/SBousseaden/status/1490608838701166596
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Created by Client With PID 0 or Parent PID 0
id: 42e83254-1cfa-4d6e-9c16-3216cefaf6d0
related:
- id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
type: similar
- id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
type: derived
status: test
description: This rule flags Windows service creation events (Security Event ID 4697) where the creating client process ID is 0 or the parent process ID is 0. Attackers may use anomalous service installation patterns to establish persistence while reducing traceability. The detection relies on Windows Security audit telemetry for EventID 4697 and the ClientProcessId/ParentProcessId fields contained in that event.
references:
- https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
- https://www.x86matthew.com/view_post?id=create_svc_rpc
- https://twitter.com/SBousseaden/status/1490608838701166596
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-15
modified: 2023-01-04
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543
logsource:
service: security
product: windows
definition: "Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"
detection:
selection_eid:
EventID: 4697
selection_pid:
- ClientProcessId: 0
- ParentProcessId: 0
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1