Windows: Detect Installation of javamtsup Service via Security Event 4697

title: "Windows: Detect Installation of javamtsup Service via Security Event 4697"
id: e0902a81-49ff-4576-bb89-a7a00cc45665
related:
  - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
    type: derived
  - id: cb062102-587e-4414-8efa-dbe3c7bf19c6
    type: derived
status: test
description: This rule identifies creation or installation of a Windows service named "javamtsup" by matching Security Event ID 4697 and the specified service name. Service installation is a common persistence technique, and attackers may use it to run malicious code as a Windows service. The detection relies on Windows Security auditing that records service installation events, specifically Event ID 4697.
references:
  - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/CosmicDuke/win_security_mal_cosmik_duke_persistence.yml
author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update), Huntrule Team
date: 2017-03-27
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1543.003
  - attack.t1569.002
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName: javamtsup
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1