Event ID 4697 — Installation of a service

A new service has been installed on the system.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Installation of software
• Supervisory or backup officer
• Potentially malicious persistance

Verifications to be carried out

1. Identify Service Name and File Name Service
2. Check the binary editor
3. Correlate with the user who performed the action

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4697} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.