Title:
Potential Execution of Sysinternals Tools
Status:
test
Description:Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools
References:
-https://twitter.com/Moti_B/status/1008587936735035392
Author: Markus Neis
Date: 2017-08-28
modified:2024-03-13
Tags:
- -'attack.resource-development'
- -'attack.t1588.002'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
CommandLine|contains|windash:
' -accepteula'
condition:
selection
Falsepositives:
-Legitimate use of SysInternals tools
-Programs that use the same command line flag
Level:
low
