huntrule

Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key

Flags registry writes to EulaAccepted for Sysinternals-named targets when executed by non-matching image filenames.

FreeUnreviewedSigmahighv1
title: "Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key"
id: 08ce3132-daa0-4326-a1a5-830f2b472746
related:
  - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
    type: derived
  - id: 8023f872-3f1d-4301-a384-801889917ab4
    type: similar
  - id: f50f3c09-557d-492d-81db-9064a8d4e211
    type: derived
status: test
description: This rule identifies registry activity where the TargetObject contains common Sysinternals tool names and ends with \EulaAccepted, indicating the EULA acceptance path associated with tool execution. An attacker may rename Sysinternals binaries to disguise execution, while still triggering the EulaAccepted registry key. It relies on Windows registry set telemetry capturing the TargetObject path and the creating process image name to exclude known legitimate binaries.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2026-06-29
tags:
  - attack.resource-development
  - attack.t1588.002
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - \Active Directory Explorer
      - \Handle
      - \LiveKd
      - \ProcDump
      - \Process Explorer
      - \PsExec
      - \PsLoggedon
      - \PsLoglist
      - \PsPasswd
      - \PsPing
      - \PsService
      - \SDelete
    TargetObject|endswith: \EulaAccepted
  filter:
    Image|endswith:
      - \ADExplorer.exe
      - \ADExplorer64.exe
      - \ADExplorer64a.exe
      - \handle.exe
      - \handle64.exe
      - \handle64a.exe
      - \livekd.exe
      - \livekd64.exe
      - \procdump.exe
      - \procdump64.exe
      - \procdump64a.exe
      - \procexp.exe
      - \procexp64.exe
      - \procexp64a.exe
      - \PsExec.exe
      - \PsExec64.exe
      - \PsExec64a.exe
      - \PsLoggedon.exe
      - \PsLoggedon64.exe
      - \psloglist.exe
      - \psloglist64.exe
      - \psloglist64a.exe
      - \pspasswd.exe
      - \pspasswd64.exe
      - \pspasswd64a.exe
      - \PsPing.exe
      - \PsPing64.exe
      - \PsPing64a.exe
      - \PsService.exe
      - \PsService64.exe
      - \PsService64a.exe
      - \sdelete.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml
license: DRL-1.1

What it detects

This rule identifies registry activity where the TargetObject contains common Sysinternals tool names and ends with \EulaAccepted, indicating the EULA acceptance path associated with tool execution. An attacker may rename Sysinternals binaries to disguise execution, while still triggering the EulaAccepted registry key. It relies on Windows registry set telemetry capturing the TargetObject path and the creating process image name to exclude known legitimate binaries.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.