CosmicDuke Service Installation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.