Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More

Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Read More

Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

Read More

Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.

Read More

Detects suspicious renamed SysInternals DebugView execution

Read More

Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)

Read More

Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only

Read More

Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution

Read More