Windows Event ID 4697 – Security-Auditing: A Service Was Installed on the System

Start by examining the specific details of Event ID 4697 to understand what service was installed and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4697 in the Event IDs field and click OK
5. Double-click on recent Event ID 4697 entries to examine details
6. Review key fields in the event details:
   • Subject: Shows the user account that installed the service
   • Service Name: The internal service name
   • Service File Name: Full path to the service executable
   • Service Type: Type of service (Win32, kernel driver, etc.)
   • Service Start Type: How the service starts (automatic, manual, disabled)
7. Cross-reference suspicious service paths with known malware indicators
8. Document any services installed from unusual locations like temp directories or user profiles

Use PowerShell to programmatically query and analyze Event ID 4697 across multiple systems or time periods.

1. Open PowerShell as Administrator
2. Query recent service installation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed service information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ServiceName = $Event.Event.EventData.Data[5].'#text'
           ServiceFileName = $Event.Event.EventData.Data[6].'#text'
           ServiceType = $Event.Event.EventData.Data[7].'#text'
           ServiceStartType = $Event.Event.EventData.Data[8].'#text'
           ServiceAccount = $Event.Event.EventData.Data[9].'#text'
           InstalledBy = $Event.Event.EventData.Data[1].'#text'
       }
   }

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} | Export-Csv -Path "C:\Temp\ServiceInstalls.csv" -NoTypeInformation

Verify whether installed services are legitimate by examining their properties and digital signatures.

1. List all services and their executable paths:

   Get-WmiObject -Class Win32_Service | Select-Object Name, DisplayName, PathName, StartMode, State | Sort-Object Name

2. Check digital signatures of service executables:

   Get-WmiObject -Class Win32_Service | ForEach-Object {
       $ServicePath = $_.PathName -replace '"', '' -split ' ' | Select-Object -First 1
       if (Test-Path $ServicePath) {
           $Signature = Get-AuthenticodeSignature -FilePath $ServicePath
           [PSCustomObject]@{
               ServiceName = $_.Name
               ExecutablePath = $ServicePath
               SignatureStatus = $Signature.Status
               SignerCertificate = $Signature.SignerCertificate.Subject
           }
       }
   }

3. Examine service properties in Services console:
   • Open services.msc
   • Locate the service mentioned in Event ID 4697
   • Right-click and select Properties
   • Review the General, Log On, and Dependencies tabs
   • Check if the service runs under a privileged account
4. Verify service executable location and properties:

   $ServiceName = "SuspiciousService"
   $Service = Get-WmiObject -Class Win32_Service -Filter "Name='$ServiceName'"
   $ExecutablePath = $Service.PathName -replace '"', '' -split ' ' | Select-Object -First 1
   Get-ItemProperty -Path $ExecutablePath | Select-Object Name, VersionInfo, CreationTime, LastWriteTime

5. Cross-reference with threat intelligence databases or submit suspicious files to VirusTotal

Set up comprehensive monitoring to track service installations across your environment proactively.

1. Enable advanced security auditing via Group Policy:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand System Audit Policies → System
   • Configure Audit Security System Extension to Success and Failure
2. Create custom Event Viewer views for service monitoring:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Set Event level to Information, Warning, and Error
   • Enter 4697 in Event IDs field
   • Name the view "Service Installations" and save
3. Set up PowerShell-based monitoring script:

   # Create monitoring script
   $ScriptContent = @'
   Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2" -Action {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} -MaxEvents 1 | ForEach-Object {
           $Event = [xml]$_.ToXml()
           $ServiceName = $Event.Event.EventData.Data[5].'#text'
           $ServicePath = $Event.Event.EventData.Data[6].'#text'
           Write-EventLog -LogName Application -Source "ServiceMonitor" -EventId 1001 -EntryType Information -Message "New service installed: $ServiceName at $ServicePath"
       }
   }
   '@
   $ScriptContent | Out-File -FilePath "C:\Scripts\ServiceMonitor.ps1"

4. Configure Windows Event Forwarding (WEF) for centralized collection:
   • Run wecutil qc on collector server
   • Create subscription configuration file
   • Configure source computers to forward security events
5. Implement SIEM integration for automated alerting on suspicious service installations

Perform detailed forensic analysis when Event ID 4697 indicates potential security incidents.

1. Collect comprehensive event correlation data:

   # Gather related security events around service installation time
   $ServiceInstallTime = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} -MaxEvents 1).TimeCreated
   $StartTime = $ServiceInstallTime.AddMinutes(-30)
   $EndTime = $ServiceInstallTime.AddMinutes(30)
   
   # Collect related events
   $RelatedEvents = @(4688, 4689, 4624, 4625, 4648, 4672, 4698, 4699, 4700, 4701, 4702)
   $RelatedEvents | ForEach-Object {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$_; StartTime=$StartTime; EndTime=$EndTime} -ErrorAction SilentlyContinue
   } | Sort-Object TimeCreated

2. Analyze process creation events leading to service installation:

   # Find process creation events that may have led to service installation
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {
       $_.Message -match "sc.exe|powershell.exe|cmd.exe|msiexec.exe"
   }

3. Examine registry changes related to service installation:
   • Check HKLM\SYSTEM\CurrentControlSet\Services for the new service key
   • Review service parameters and configuration
   • Look for unusual registry permissions or ownership
4. Perform file system analysis:

   # Analyze service executable and related files
   $ServiceExecutable = "C:\Path\To\Service.exe"
   Get-ItemProperty -Path $ServiceExecutable | Select-Object *
   Get-FileHash -Path $ServiceExecutable -Algorithm SHA256
   
   # Check for additional files in the same directory
   Get-ChildItem -Path (Split-Path $ServiceExecutable) -Recurse | Select-Object Name, CreationTime, LastWriteTime, Length

5. Document findings and create incident timeline:
   • Correlate all events with user activities and system changes
   • Identify the attack vector and persistence mechanism
   • Determine scope of compromise and affected systems
   • Prepare remediation plan including service removal and system hardening
6. Preserve evidence for potential legal proceedings:

   # Export all related events to EVTX format for preservation
   wevtutil epl Security C:\Evidence\Security_$(Get-Date -Format 'yyyyMMdd_HHmmss').evtx "/q:*[System[EventID=4697]]"
   
   # Create forensic image of service executable
   Copy-Item -Path $ServiceExecutable -Destination "C:\Evidence\" -Force