Sigma rule: Usage of Renamed Sysinternals Tools - RegistrySet

Rule

Title

Usage of Renamed Sysinternals Tools - RegistrySet

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-24

Modified

2026-06-29

File

rules/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains:
        - '\PsExec'
        - '\ProcDump'
        - '\Handle'
        - '\LiveKd'
        - '\Process Explorer'
        - '\PsLoglist'
        - '\PsPasswd'
        - '\Active Directory Explorer'
    TargetObject|endswith: '\EulaAccepted'
filter_main_image_names:
    Image|endswith:
        - '\PsExec.exe'
        - '\PsExec64.exe'
        - '\PsExec64a.exe'
        - '\procdump.exe'
        - '\procdump64.exe'
        - '\procdump64a.exe'
        - '\handle.exe'
        - '\handle64.exe'
        - '\handle64a.exe'
        - '\livekd.exe'
        - '\livekd64.exe'
        - '\procexp.exe'
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\psloglist.exe'
        - '\psloglist64.exe'
        - '\psloglist64a.exe'
        - '\pspasswd.exe'
        - '\pspasswd64.exe'
        - '\pspasswd64a.exe'
        - '\ADExplorer.exe'
        - '\ADExplorer64.exe'
        - '\ADExplorer64a.exe'
filter_optional_null:
    Image: null # Race condition with some logging tools
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.resource-development
• attack.t1588.002

MITRE ATT&CK ids this rule names

• T1588.002

Related rules

• 25ffa65d-76d8-4da5-a832-3f2b0136e133 (derived)
• f50f3c09-557d-492d-81db-9064a8d4e211 (similar)

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml