Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

FreeUnreviewedSigmalowv1

windows-command-line-execution-using-sysinternals-accepteula-flag-7cccd811

title: "Windows: Command-line execution using Sysinternals -accepteula flag"
id: 6b69dd15-71cb-46ac-9c30-a7d465796722
related:
  - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
    type: derived
  - id: 7cccd811-7ae9-4ebe-9afd-cb5c406b824b
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains the Sysinternals-related -accepteula flag. Adversaries and legitimate administrators may use Sysinternals utilities, and accepting the EULA via this flag can be part of automated execution patterns. The detection relies on process_creation telemetry with access to the full command line.
references:
  - https://twitter.com/Moti_B/status/1008587936735035392
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml
author: Markus Neis, Huntrule Team
date: 2017-08-28
modified: 2024-03-13
tags:
  - attack.resource-development
  - attack.t1588.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|windash: " -accepteula"
  condition: selection
falsepositives:
  - Legitimate use of SysInternals tools
  - Programs that use the same command line flag
level: low
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains the Sysinternals-related -accepteula flag. Adversaries and legitimate administrators may use Sysinternals utilities, and accepting the EULA via this flag can be part of automated execution patterns. The detection relies on process_creation telemetry with access to the full command line.

Known false positives

Legitimate use of SysInternals tools
Programs that use the same command line flag

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.