CosmicDuke Service Installation

calendar May 13, 2024 · attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging_threats  ·
Share on: linkedin copy

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Sigma rule (View on GitHub)

 1title: CosmicDuke Service Installation
 2id: cb062102-587e-4414-8efa-dbe3c7bf19c6
 3related:
 4    - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
 5      type: derived
 6status: test
 7description: |
 8    Detects the installation of a service named "javamtsup" on the system.
 9    The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.    
10references:
11    - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
12author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
13date: 2017/03/27
14modified: 2022/10/09
15tags:
16    - attack.persistence
17    - attack.t1543.003
18    - attack.t1569.002
19    - detection.emerging_threats
20logsource:
21    product: windows
22    service: security
23    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
24detection:
25    selection:
26        EventID: 4697
27        ServiceName: 'javamtsup'
28    condition: selection
29falsepositives:
30    - Unlikely
31level: critical

References

  • %PDF-1.7 %âãÏÓ 354 0 obj endobj xref 354 67 0000000016 00000 n 0000002625 00000 n 0000002837 00000 n 0000002873 00000 n 0000003314 00000 n 0000003469 00000 n 0000003607 00000 n 0000003745 00000 n 0...


    Read More

Related rules

to-top