Usage of Renamed Sysinternals Tools - RegistrySet

Title: Usage of Renamed Sysinternals Tools - RegistrySet
Status: test
Description:Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
modified:2026-06-29
Tags:

• -'attack.resource-development'
• -'attack.t1588.002'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains:
      -'\PsExec'
      -'\ProcDump'
      -'\Handle'
      -'\LiveKd'
      -'\Process Explorer'
      -'\PsLoglist'
      -'\PsPasswd'
      -'\Active Directory Explorer'

    TargetObject|endswith: '\EulaAccepted'
  filter_main_image_names:
    Image|endswith:
      -'\PsExec.exe'
      -'\PsExec64.exe'
      -'\PsExec64a.exe'
      -'\procdump.exe'
      -'\procdump64.exe'
      -'\procdump64a.exe'
      -'\handle.exe'
      -'\handle64.exe'
      -'\handle64a.exe'
      -'\livekd.exe'
      -'\livekd64.exe'
      -'\procexp.exe'
      -'\procexp64.exe'
      -'\procexp64a.exe'
      -'\psloglist.exe'
      -'\psloglist64.exe'
      -'\psloglist64a.exe'
      -'\pspasswd.exe'
      -'\pspasswd64.exe'
      -'\pspasswd64a.exe'
      -'\ADExplorer.exe'
      -'\ADExplorer64.exe'
      -'\ADExplorer64a.exe'

  filter_optional_null:
    Image: 'None'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unlikely
Level: high