Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key
Flags registry writes to EulaAccepted for Sysinternals-named targets when executed by non-matching image filenames.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-24
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry activity where the TargetObject contains common Sysinternals tool names and ends with \EulaAccepted, indicating the EULA acceptance path associated with tool execution. An attacker may rename Sysinternals binaries to disguise execution, while still triggering the EulaAccepted registry key. It relies on Windows registry set telemetry capturing the TargetObject path and the creating process image name to exclude known legitimate binaries.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key"
id: 08ce3132-daa0-4326-a1a5-830f2b472746
related:
- id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
type: derived
- id: 8023f872-3f1d-4301-a384-801889917ab4
type: similar
- id: f50f3c09-557d-492d-81db-9064a8d4e211
type: derived
status: test
description: This rule identifies registry activity where the TargetObject contains common Sysinternals tool names and ends with \EulaAccepted, indicating the EULA acceptance path associated with tool execution. An attacker may rename Sysinternals binaries to disguise execution, while still triggering the EulaAccepted registry key. It relies on Windows registry set telemetry capturing the TargetObject path and the creating process image name to exclude known legitimate binaries.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2026-06-29
tags:
- attack.resource-development
- attack.t1588.002
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains:
- \Active Directory Explorer
- \Handle
- \LiveKd
- \ProcDump
- \Process Explorer
- \PsExec
- \PsLoggedon
- \PsLoglist
- \PsPasswd
- \PsPing
- \PsService
- \SDelete
TargetObject|endswith: \EulaAccepted
filter:
Image|endswith:
- \ADExplorer.exe
- \ADExplorer64.exe
- \ADExplorer64a.exe
- \handle.exe
- \handle64.exe
- \handle64a.exe
- \livekd.exe
- \livekd64.exe
- \procdump.exe
- \procdump64.exe
- \procdump64a.exe
- \procexp.exe
- \procexp64.exe
- \procexp64a.exe
- \PsExec.exe
- \PsExec64.exe
- \PsExec64a.exe
- \PsLoggedon.exe
- \PsLoggedon64.exe
- \psloglist.exe
- \psloglist64.exe
- \psloglist64a.exe
- \pspasswd.exe
- \pspasswd64.exe
- \pspasswd64a.exe
- \PsPing.exe
- \PsPing64.exe
- \PsPing64a.exe
- \PsService.exe
- \PsService64.exe
- \PsService64a.exe
- \sdelete.exe
condition: selection and not filter
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml
license: DRL-1.1