Windows Registry Key Created: Sysinternals EULA Acceptance
Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.
- Product
- windows
- Category
- registry_set
- Author
- Markus Neis (SigmaHQ), DRL 1.1
- Published
- 2017-08-28
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation of the Sysinternals EULA acceptance registry value by matching a registry TargetObject that ends with \EulaAccepted. Attackers and unwanted programs may create this key to indicate Sysinternals tooling has been configured or accepted for use. The detection relies on Windows registry set telemetry that records the TargetObject name for registry writes.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Key Created: Sysinternals EULA Acceptance"
id: ad334872-8a81-4e43-91fb-101a9281f6d0
status: test
description: This rule identifies creation of the Sysinternals EULA acceptance registry value by matching a registry TargetObject that ends with \EulaAccepted. Attackers and unwanted programs may create this key to indicate Sysinternals tooling has been configured or accepted for use. The detection relies on Windows registry set telemetry that records the TargetObject name for registry writes.
references:
- https://twitter.com/Moti_B/status/1008587936735035392
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula.yml
author: Markus Neis, Huntrule Team
date: 2017-08-28
modified: 2025-10-26
tags:
- attack.resource-development
- attack.t1588.002
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|endswith: \EulaAccepted
condition: selection
falsepositives:
- Legitimate use of SysInternals tools
- Programs that use the same Registry Key
level: low
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula/info.yml
license: DRL-1.1
related:
- id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
type: derived