Potential Execution of Sysinternals Tools

A Sigma rule for process creation on Windows, by Markus Neis.

low 1 ATT&CK technique 12 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    CommandLine|contains|windash: ' -accepteula'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Markus Neis, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Get detailed information and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEulaIdentify

Get detailed information and save the logs to a specific directory on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEula -LogFolder path\to\directoryIdentify

Get detailed information without showing the progress on the page for gethelpcmd-expertexperienceadmintask

GetHelpCmd.exe -S ExpertExperienceAdminTask -AcceptEula -HideProgressIdentify

Automatically fix activation-related errors, close Office, and accept this command's End-User License Agreement (EULA). Requires Administrator privileges to do so on the page for gethelpcmd-officeactivationscenario

GetHelpCmd.exe -S OfficeActivationScenario -AcceptEula -CloseOfficeIdentify

Detach the currently-installed Office licensing scheme from Shared Computer Activation (SCA), and activate the product separately. Requires Administrator privileges to do so on the page for gethelpcmd-officeactivationscenario

GetHelpCmd.exe -S OfficeActivationScenario -AcceptEula -CloseOffice -RemoveSCAIdentify

Analyze the calendar for the current, active profile, and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEulaIdentify

Analyze calendar for a specific Outlook profile on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profileIdentify

Analyze the calendar for a specific profile and save the logs to a specific directory on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profile -LogFolder path\to\directoryIdentify

Analyze the calendar for a specific profile without showing the progress on the page for gethelpcmd-outlookcalendarchecktask

GetHelpCmd.exe -S OutlookCalendarCheckTask -AcceptEula -P profile -HideProgressIdentify

Run the troubleshooter, close Outlook, and accept this command's End-User License Agreement (EULA) on the page for gethelpcmd-teamsaddinscenario

GetHelpCmd.exe -S TeamsAddinScenario -AcceptEula -CloseOutlookIdentify

To install Sysmon with default settings, run the following command on the page for sysmon

sysmon -accepteula -iIdentify

To install Sysmon with a configuration file, run the following command on the page for sysmon

sysmon -accepteula -i c:\windows\config.xmlIdentify

ATT&CK

the techniques it is tagged with

T1588.002Obtain Capabilities: Tool

Potential Execution of Sysinternals Tools

What it looks for

Command lines that trip it

ATT&CK

Other rules for T1588.002 Obtain Capabilities: Tool