Windows Service Created by Client With PID 0 or Parent PID 0

Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Tim Rauch (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-09-15
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1543Create or Modify System Process
Priv Esc
- T1543Create or Modify System Process
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows service creation events (Security Event ID 4697) where the creating client process ID is 0 or the parent process ID is 0. Attackers may use anomalous service installation patterns to establish persistence while reducing traceability. The detection relies on Windows Security audit telemetry for EventID 4697 and the ClientProcessId/ParentProcessId fields contained in that event.

Reporting behind it

Related detections9 linkedT1543 — drag to rearrange

Suspicious GitHub Actions Runner In Hidden Directory via Shell (via process_creation)

Suspicious Self-Hosted GitHub Actions Runner Started As Root via Shell (via process_creation)

Suspicious GitHub Self-Hosted Runner Registration via Audit Log (via github)

Malicious Fire Ant Hypervisor Backdoor Artifacts on ESXi and vCenter (via file_event)

Suspicious D-Bus System Service Persistence File Creation

Malicious BRICKSTORM Backdoor Execution via Masqueraded Binary Path

Suspicious SonicWall SMA init.d Persistence Launching deploy_new.py

Malicious Linux XorDDoS gcc.pid Device Marker File via file_event

Windows Code Integrity: Blocked Driver Load Due to Revoked Certificate (Event ID 3023)

Windows Service Created by Client With PID 0 or Parent PID 0

Pivot detection · T1543 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-installation-via-unusual-client-clientprocessid-or-parentprocess-c4e92a97

title: Windows Service Created by Client With PID 0 or Parent PID 0
id: 42e83254-1cfa-4d6e-9c16-3216cefaf6d0
related:
  - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
    type: similar
  - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
    type: derived
status: test
description: This rule flags Windows service creation events (Security Event ID 4697) where the creating client process ID is 0 or the parent process ID is 0. Attackers may use anomalous service installation patterns to establish persistence while reducing traceability. The detection relies on Windows Security audit telemetry for EventID 4697 and the ClientProcessId/ParentProcessId fields contained in that event.
references:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
  - https://www.x86matthew.com/view_post?id=create_svc_rpc
  - https://twitter.com/SBousseaden/status/1490608838701166596
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-15
modified: 2023-01-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  service: security
  product: windows
  definition: "Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"
detection:
  selection_eid:
    EventID: 4697
  selection_pid:
    - ClientProcessId: 0
    - ParentProcessId: 0
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL