programs that use the same command line flag

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml>sigma
technicques: t1588 t1588.002

Techniques

Detects command lines that contain the ‘accepteula’ flag which could be a sign of execution of one of the Sysinternals tools

condition: selection
selection:
  CommandLine|contains|windash: ' -accepteula'