Windows RegistrySet: EulaAccepted set for renamed Sysinternals tools
Flags Windows registry writes to \EulaAccepted for Sysinternals-related objects when performed by non-matching executables.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-24
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry writes where the TargetObject contains specific Sysinternals-related path patterns and ends with \EulaAccepted, indicating the EULA acceptance flag was set. It then excludes events where the setting is performed by the expected Sysinternals executable image names. Attackers may use renamed or proxy binaries to blend in while still setting the same EULA acceptance registry value, so the detection relies on Windows RegistrySet telemetry capturing TargetObject and the writing process Image.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows RegistrySet: EulaAccepted set for renamed Sysinternals tools"
id: 3e6b7617-0113-4a1c-8fb8-9249ca818b25
related:
- id: 25ffa65d-76d8-4da5-a832-3f2b0136e133
type: derived
- id: f50f3c09-557d-492d-81db-9064a8d4e211
type: similar
- id: 8023f872-3f1d-4301-a384-801889917ab4
type: derived
status: test
description: This rule identifies registry writes where the TargetObject contains specific Sysinternals-related path patterns and ends with \EulaAccepted, indicating the EULA acceptance flag was set. It then excludes events where the setting is performed by the expected Sysinternals executable image names. Attackers may use renamed or proxy binaries to blend in while still setting the same EULA acceptance registry value, so the detection relies on Windows RegistrySet telemetry capturing TargetObject and the writing process Image.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2026-06-29
tags:
- attack.resource-development
- attack.t1588.002
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains:
- \PsExec
- \ProcDump
- \Handle
- \LiveKd
- \Process Explorer
- \PsLoglist
- \PsPasswd
- \Active Directory Explorer
TargetObject|endswith: \EulaAccepted
filter_main_image_names:
Image|endswith:
- \PsExec.exe
- \PsExec64.exe
- \PsExec64a.exe
- \procdump.exe
- \procdump64.exe
- \procdump64a.exe
- \handle.exe
- \handle64.exe
- \handle64a.exe
- \livekd.exe
- \livekd64.exe
- \procexp.exe
- \procexp64.exe
- \procexp64a.exe
- \psloglist.exe
- \psloglist64.exe
- \psloglist64a.exe
- \pspasswd.exe
- \pspasswd64.exe
- \pspasswd64a.exe
- \ADExplorer.exe
- \ADExplorer64.exe
- \ADExplorer64a.exe
filter_optional_null:
Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1