CosmicDuke Service Installation

calendar Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats  ·
Share on: linkedin copy

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Sigma rule (View on GitHub)

 1title: CosmicDuke Service Installation
 2id: cb062102-587e-4414-8efa-dbe3c7bf19c6
 3related:
 4    - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
 5      type: derived
 6status: test
 7description: |
 8    Detects the installation of a service named "javamtsup" on the system.
 9    The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.    
10references:
11    - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
12author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
13date: 2017-03-27
14modified: 2022-10-09
15tags:
16    - attack.privilege-escalation
17    - attack.execution
18    - attack.persistence
19    - attack.t1543.003
20    - attack.t1569.002
21    - detection.emerging-threats
22logsource:
23    product: windows
24    service: security
25    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
26detection:
27    selection:
28        EventID: 4697
29        ServiceName: 'javamtsup'
30    condition: selection
31falsepositives:
32    - Unlikely
33level: critical

References

Related rules

to-top