huntrule

Windows Service Created by Client With PID 0 or Parent PID 0

Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Tim Rauch (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
Published
2022-09-15
Updated
2026-07-31
AnalysisDetection
title: Windows Service Created by Client With PID 0 or Parent PID 0
id: 42e83254-1cfa-4d6e-9c16-3216cefaf6d0
related:
  - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
    type: similar
  - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
    type: derived
status: test
description: This rule flags Windows service creation events (Security Event ID 4697) where the creating client process ID is 0 or the parent process ID is 0. Attackers may use anomalous service installation patterns to establish persistence while reducing traceability. The detection relies on Windows Security audit telemetry for EventID 4697 and the ClientProcessId/ParentProcessId fields contained in that event.
references:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
  - https://www.x86matthew.com/view_post?id=create_svc_rpc
  - https://twitter.com/SBousseaden/status/1490608838701166596
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-15
modified: 2023-01-04
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543
logsource:
  service: security
  product: windows
  definition: "Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697"
detection:
  selection_eid:
    EventID: 4697
  selection_pid:
    - ClientProcessId: 0
    - ParentProcessId: 0
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1