Service installed
Detects installation of a new Windows service (Security 4697 / System 7045).
What it detects
Detects installation of a new Windows service (Security 4697 / System 7045). New services provide SYSTEM-level persistence and are a favorite of remote-execution tooling.
MITRE ATT&CK mapping
- T1543.003Create or Modify System Process: Windows Service· Persistence
False positives and triage
Driver and agent installations create services legitimately. Check the binary path, signer, and whether a change window was open.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/service_installed.yaml, licensed under the Apache License 2.0.
id: windows.persistence.service_installed
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1543.003]
description: |
Detects installation of a new Windows service (Security 4697 / System 7045). New services
provide SYSTEM-level persistence and are a favorite of remote-execution tooling.
match:
event_category: service
event_action: service_created
false_positive_guidance: |
Driver and agent installations create services legitimately. Check the binary path,
signer, and whether a change window was open.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.