CosmicDuke Service Installation

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Sigma rule (View on GitHub)

 1title: CosmicDuke Service Installation
 2id: cb062102-587e-4414-8efa-dbe3c7bf19c6
 3related:
 4    - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
 5      type: derived
 6status: test
 7description: |
 8    Detects the installation of a service named "javamtsup" on the system.
 9    The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.    
10references:
11    - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
12author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
13date: 2017-03-27
14modified: 2022-10-09
15tags:
16    - attack.persistence
17    - attack.t1543.003
18    - attack.t1569.002
19    - detection.emerging-threats
20logsource:
21    product: windows
22    service: security
23    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
24detection:
25    selection:
26        EventID: 4697
27        ServiceName: 'javamtsup'
28    condition: selection
29falsepositives:
30    - Unlikely
31level: critical

References

Related rules

to-top