As you know, Ransomware often attempts to gain persistence on a compromised system by modifying or creating system services. This allows the malware to automatically run on system startup or at regular intervals to encrypt files. The addition of the service will obviously trigger the Event ID 4697 and hence it is important for SOC team to set SIEM rules for this event. Microsoft also has specific recommendations for security monitoring (Read Here) which makes this event an important monitoring target.
Below are some ways ransomware can trigger Event ID 4697:
- Creating a new malicious service to execute the ransomware payload
- Modifying an existing legitimate service to run the ransomware instead of its normal functionality
- Changing the binary path of a service to point to the ransomware executable
Detecting Ransomware via Event ID 4697
Mentioned below is the list of actions that Security analysts can take while reviewing the Event ID 4697 logs for any potential ransomware activity:
- Look for service installations with unusual binary paths, like those in the %APPDATA% folder, ransomware groups typically add new services under %APPDATA% folder as no admin rights are needed.
- Monitor for services with suspicious names or descriptions that don’t match legitimate Windows services.
- Check if the service is configured to automatically start, which is common for ransomware persistence
- Identify services running under user accounts rather than the standard LocalSystem, LocalService or NetworkService accounts
Analysts can use free tools like
- You can leverage the free tools like “Process Explorer” from Microsoft, or Netstat.
Note that Event ID 4697 alone does not pinpoint towards a ransomware attack, SOC team needs to correlate this with other suspicious events like process creations, network connections, and file changes to arrive at a conclusion.
