win:security 4697

Attempt to install a service.

Log source: Windows Security event log
Host type: Windows (workstation, member server, domain controller)
How to enable: Advanced Audit Policy: System > Audit Security System Extension
Audit category: System
Audit subcategory: Audit Security System Extension
Tier, host type: Minimum
Techniques: 5
Rules depending on it: Sigma 21, Elastic 1, Microsoft Sentinel 1

Why this tier

DISA STIG (server); DISA STIG (workstation); Microsoft audit baseline (dc); Microsoft audit baseline (server); Microsoft audit baseline (workstation)

By role

Role	Tier	Basis
Windows workstation	Minimum	DISA STIG (workstation); Microsoft audit baseline (workstation)
Windows member server	Minimum	DISA STIG (server); Microsoft audit baseline (server)
Windows domain controller	Minimum	DISA STIG (server); Microsoft audit baseline (dc); Microsoft audit baseline (server)
Windows web server (IIS), internet-facing	Minimum	DISA STIG (server); Microsoft audit baseline (server)

Techniques it helps detect

Rules that depend on it

Sigma 21

CosmicDuke Service Installation by Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
Credential Dumping Tools Service Execution - Security by Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
HybridConnectionManager Service Installation by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Invoke-Obfuscation CLIP+ Launcher - Security by Jonathan Cheong, oscd.community
Invoke-Obfuscation COMPRESS OBFUSCATION - Security by Timur Zinniatullin, oscd.community
Invoke-Obfuscation Obfuscated IEX Invocation - Security by Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Invoke-Obfuscation RUNDLL LAUNCHER - Security by Timur Zinniatullin, oscd.community
Invoke-Obfuscation STDIN+ Launcher - Security by Jonathan Cheong, oscd.community
Invoke-Obfuscation VAR+ Launcher - Security by Jonathan Cheong, oscd.community
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security by Timur Zinniatullin, oscd.community
Invoke-Obfuscation Via Stdin - Security by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Clip - Security by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use MSHTA - Security by Nikita Nazarov, oscd.community
Invoke-Obfuscation Via Use Rundll32 - Security by Nikita Nazarov, oscd.community
Metasploit Or Impacket Service Installation Via SMB PsExec by Bartlomiej Czyz, Relativity
Meterpreter or Cobalt Strike Getsystem Service Installation - Security by Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
PowerShell Scripts Installed as Services - Security by oscd.community, Natalia Shornikova
Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)
Service Installed By Unusual Client - Security by Tim Rauch (Nextron Systems), Elastic (idea)
Tap Driver Installation - Security by Daniil Yugoslavskiy, Ian Davis, oscd.community
Windows Pcap Drivers by Cian Heasley

Elastic 1

Suspicious Service was Installed in the System

Microsoft Sentinel 1

Gain Code Execution on ADFS Server via SMB + Remote Service or Scheduled Task

Standards and guidance naming it

Requirement	Relation	Basis
DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05)	Names this event	WN11-AU-000150 (workstation): Audit Security System Extension Success
DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2022 V2R11	Names this event	WN22-AU-000370 (server): Audit Security System Extension Success
DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23)	Names this event	WN10-AU-000150 (workstation): Audit Security System Extension Success
DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2019 V3R9 (2026-07-10)	Names this event	WN19-AU-000370 (server): Audit Security System Extension Success
DISA STIG: Advanced audit policy requirementsMicrosoft Windows Server 2025 V1R1 (2026-02-27)	Names this event	WN25-AU-000370 (server): Audit Security System Extension Success
Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices)	Names this event	potential criticality Low: Attempt to install a service.