Windows Service Creation: ServiceName javamtsup (Event ID 4697)
Flags Windows Security Event 4697 when a service named "javamtsup" is installed, indicating potential persistence.
- Product
- windows
- Service
- security
- Author
- Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update) (SigmaHQ), DRL 1.1
- Published
- 2017-03-27
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of a Windows service specifically named "javamtsup" using Security audit Event ID 4697. Attackers may use Windows services to establish persistence and execute code under the service control manager. The detection relies on Windows Security logs that include the EID 4697 service installation event and the recorded ServiceName field.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Creation: ServiceName javamtsup (Event ID 4697)"
id: e0902a81-49ff-4576-bb89-a7a00cc45665
related:
- id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
type: derived
- id: cb062102-587e-4414-8efa-dbe3c7bf19c6
type: derived
status: test
description: This rule flags creation of a Windows service specifically named "javamtsup" using Security audit Event ID 4697. Attackers may use Windows services to establish persistence and execute code under the service control manager. The detection relies on Windows Security logs that include the EID 4697 service installation event and the recorded ServiceName field.
references:
- https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/CosmicDuke/win_security_mal_cosmik_duke_persistence.yml
author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update), Huntrule Team
date: 2017-03-27
modified: 2022-10-09
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1543.003
- attack.t1569.002
- detection.emerging-threats
logsource:
product: windows
service: security
definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
selection:
EventID: 4697
ServiceName: javamtsup
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1