// REFERENCE
4697 — A service was installed (Security)
Log: Security
High risk
Equivalent to 7045 but in the Security log (requires auditing "Security System Extension"). Preferable to 7045 in domains because it's collected via standard audit policy. Review the service name and binary.
Related tools
Work with this in:
Related
7045
7045 — A service was installed 7040
7040 — Service start type changed 4698
4698 — A scheduled task was created 4699
4699 — A scheduled task was deleted 4700
4700 — A scheduled task was enabled 4702
4702 — A scheduled task was updated
7045 — A service was installed 7040
7040 — Service start type changed 4698
4698 — A scheduled task was created 4699
4699 — A scheduled task was deleted 4700
4700 — A scheduled task was enabled 4702
4702 — A scheduled task was updated
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.