Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Detects suspicious renamed SysInternals DebugView execution

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only