Windows Registry Key Created: Sysinternals EULA Acceptance

Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.

FreeUnreviewedSigmalowv1

windows-registry-key-created-sysinternals-eula-acceptance-25ffa65d

title: "Windows Registry Key Created: Sysinternals EULA Acceptance"
id: ad334872-8a81-4e43-91fb-101a9281f6d0
status: test
description: This rule identifies creation of the Sysinternals EULA acceptance registry value by matching a registry TargetObject that ends with \EulaAccepted. Attackers and unwanted programs may create this key to indicate Sysinternals tooling has been configured or accepted for use. The detection relies on Windows registry set telemetry that records the TargetObject name for registry writes.
references:
  - https://twitter.com/Moti_B/status/1008587936735035392
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula.yml
author: Markus Neis, Huntrule Team
date: 2017-08-28
modified: 2025-10-26
tags:
  - attack.resource-development
  - attack.t1588.002
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \EulaAccepted
  condition: selection
falsepositives:
  - Legitimate use of SysInternals tools
  - Programs that use the same Registry Key
level: low
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula/info.yml
license: DRL-1.1
related:
  - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
    type: derived

What it detects

This rule identifies creation of the Sysinternals EULA acceptance registry value by matching a registry TargetObject that ends with \EulaAccepted. Attackers and unwanted programs may create this key to indicate Sysinternals tooling has been configured or accepted for use. The detection relies on Windows registry set telemetry that records the TargetObject name for registry writes.

Known false positives

Legitimate use of SysInternals tools
Programs that use the same Registry Key

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.