huntrule

Windows Service Creation: ServiceName javamtsup (Event ID 4697)

Flags Windows Security Event 4697 when a service named "javamtsup" is installed, indicating potential persistence.

FreeReviewedSigma · Critical · v5
Product
windows
Service
security
Author
Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update) (SigmaHQ), DRL 1.1
Published
2017-03-27
Updated
2026-07-31
AnalysisDetection
title: "Windows Service Creation: ServiceName javamtsup (Event ID 4697)"
id: e0902a81-49ff-4576-bb89-a7a00cc45665
related:
  - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
    type: derived
  - id: cb062102-587e-4414-8efa-dbe3c7bf19c6
    type: derived
status: test
description: This rule flags creation of a Windows service specifically named "javamtsup" using Security audit Event ID 4697. Attackers may use Windows services to establish persistence and execute code under the service control manager. The detection relies on Windows Security logs that include the EID 4697 service installation event and the recorded ServiceName field.
references:
  - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/CosmicDuke/win_security_mal_cosmik_duke_persistence.yml
author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update), Huntrule Team
date: 2017-03-27
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1543.003
  - attack.t1569.002
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceName: javamtsup
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1