DFIRHub

Windows event log ยท Security4697 A service was installed on the system

  • Security
  • 6 fields
  • Security.evtx
  • Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • UserName%domain%\%user%
    • %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
    • %user% = /Event/EventData/Data[@Name="SubjectUserName"]
  • PayloadData1ServiceName: %ServiceName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
  • PayloadData2ServiceFileName: %ServiceFileName%
    • %ServiceFileName% = /Event/EventData/Data[@Name="ServiceFileName"]
  • PayloadData3ServiceType: %ServiceType%
    • %ServiceType% = /Event/EventData/Data[@Name="ServiceType"]
  • PayloadData4ServiceStartType: %ServiceStartType%
    • %ServiceStartType% = /Event/EventData/Data[@Name="ServiceStartType"]
  • PayloadData5ServiceAccount: %ServiceAccount%
    • %ServiceAccount% = /Event/EventData/Data[@Name="ServiceAccount"]

Value lookups

Codes that EvtxECmd turns into text

ServiceType

0x1
Kernel Driver
0x2
File System Driver
0x8
Recognizer Driver
0x10
Win32 Own Process
0x20
Win32 Share Process
0x110
Interactive Own Process
0x120
Interactive Share Process

ServiceStartType

0
Boot
1
System
2
Automatic
3
Manual
4
Disabled

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/>
    <EventID>4697</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12289</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2015-11-12T01:36:11.991070500Z"/>
    <EventRecordID>2778</EventRecordID>
    <Correlation ActivityID="{913FBE70-1CE6-0000-67BF-3F91E61CD101}"/>
    <Execution ProcessID="736" ThreadID="2800"/>
    <Channel>Security</Channel>
    <Computer>WIN-GG82ULGC9GO.contoso.local</Computer>
    <Security/>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">WIN-GG82ULGC9GO$</Data>
    <Data Name="SubjectDomainName">CONTOSO</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="ServiceName">AppHostSvc</Data>
    <Data Name="ServiceFileName">%windir%\\system32\\svchost.exe -k apphost</Data>
    <Data Name="ServiceType">0x20</Data>
    <Data Name="ServiceStartType">2</Data>
    <Data Name="ServiceAccount">localSystem</Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4697.map(opens in new tab) by Mark Hallman and contributors(opens in new tab), MIT License(opens in new tab)