Direct answer
Event 4697 records a service installation in the Security log when applicable auditing is enabled. Compare the service, installer identity and executable with an approved change.
Interpret installation evidence
Microsoft documents the service name, file, type, start type and account among event details. A service installation can be part of a legitimate application or driver deployment. The event is not a malware verdict and does not alone show that the service ran.
Reference: Microsoft: Security event 4697.
Collect details safely
Capture the affected device, time, subject, service name, executable path, start type and service account. Preserve the original event in restricted storage and ask the asset owner about its purpose. Do not execute the binary or copy service-account credentials into a ticket.
Compare with change records
A security agent installer can create a service during a planned rollout. An unexpected service running a binary from a writable user directory outside that window warrants closer review of its source, ownership and related process activity. Check whether the observed configuration has changed since installation.
Coordinate response
Correlate with software deployment, process and change records, noting missing or delayed logs. Involve the incident team before stopping a service that may support the device or evidence collection. If an unauthorized change is confirmed, document the fix and verify required service behavior afterward.
Keep the original event and an inventory snapshot so the reviewer can see whether the service configuration changed after it was installed.
Assessment limits
The event records installation, not all later service changes or execution. Audit policy and log collection affect visibility.
Frequently asked questions
Does a new service mean malware?
No. Validate its purpose, source, account and approved deployment.
Does installation prove the service ran?
No. Examine service state and execution evidence separately.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.