Detecting Windows Service Persistence: Events 7045 and 4697

Creating a Windows service gives an attacker code execution as SYSTEM that starts before any user logs on. It is also how PsExec-style lateral movement, ransomware deployment and many backdoors execute. Service Control Manager logs every installation as System Event 7045, and the Security log adds Event 4697 where auditing is enabled. Both carry the service name and the exact ImagePath, which is the field to analyse.

Signals at a Glance

Installation Events and ImagePath

The Security log version, Event 4697, is parsed into discrete fields by most SIEM connectors, which makes the ImagePath easy to hunt. Random-looking service names, ImagePaths that wrap a shell, and services pointing at user-writable directories account for most true positives:

// KQL (Sentinel): suspicious service installs from Security 4697
SecurityEvent
| where EventID == 4697
| where ServiceFileName matches regex @"(?i)(\\Temp\\|\\AppData\\|\\ProgramData\\|\\Users\\Public\\|cmd(\.exe)?\s+/c|powershell|%COMSPEC%|\\\\[^\\]+\\)"
   or ServiceName matches regex @"^[A-Za-z0-9]{8,16}$"
| project TimeGenerated, Computer, SubjectUserName, ServiceName, ServiceFileName,
          ServiceType, ServiceStartType
| order by TimeGenerated desc
// tune/validate: the random-name clause is noisy; keep it only for hosts without management agents.

Event 4697 is not always enabled, so the System log version is the safer base. This Sigma rule covers 7045 and mirrors what most public rule sets look for:

title: Suspicious Service Installed
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  susp_path:
    ImagePath|contains:
      - '\Temp\'
      - '\AppData\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\\127.0.0.1\'
      - 'cmd.exe /c'
      - 'powershell'
  condition: selection and susp_path
level: high
# tune/validate: legitimate agents install from ProgramData; baseline before paging on it.

Context That Separates Persistence from Admin Work

• Check the creator. A service installed by an interactive admin during a change window is routine; one installed remotely, seconds after a network logon, matches PsExec-style execution.
• Compare ImagePath against signature and prevalence. An unsigned binary seen on one host that registers as auto-start is the profile of a backdoor.
• Watch the registry path directly with Sysmon 13 on HKLM\System\CurrentControlSet\Services\*\ImagePath, because sc.exe config and direct registry edits bypass a 7045 install event.
• Treat driver services separately: a new kernel driver on a server, particularly one that is unsigned or appears on a vulnerable-driver blocklist, is a high-priority hunt.
• Look for short-lived services that install, start and delete within seconds. Their persistence value is nil but they are a reliable lateral-movement indicator.