huntrule

Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
Markus Neis (SigmaHQ), DRL 1.1
Published
2017-08-28
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Resource Dev

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line contains the Sysinternals-related -accepteula flag. Adversaries and legitimate administrators may use Sysinternals utilities, and accepting the EULA via this flag can be part of automated execution patterns. The detection relies on process_creation telemetry with access to the full command line.

Reporting behind it

Related detections9 linkedT1588.002 — drag to rearrange
Malicious Viper C2 Installation via f8x One-Liner Setup Script (via process_creation)
Windows RegistrySet: EulaAccepted set for renamed Sysinternals tools
Windows Registry Set: Sysinternals EULA Accepted Key for PUA Tool Execution
Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key
Windows Hacktool Execution via PE Metadata Company Field
Windows Hacktool Execution Flagged by Imphash in Process Creation
Windows: Renamed Sysinternals DebugView Process Execution
Windows Registry: Suspicious Keyboard Layout Preload in User Session
Windows Registry Key Created: Sysinternals EULA Acceptance
Windows: Command-line execution using Sysinternals -accepteula flag
Pivot detection · T1588.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.