PUA - Sysinternals Tools Execution - Registry

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.