Non-Legitimate Executable Using AcceptEula Parameter

legit_commandline:
  process.command_line
| contains: accepteula
filter:
  process.command_line
| contains:
    - accesschk.exe
    - accesschk64.exe
    - accessenum.exe
    - adexplorer.exe
    - adexplorer64.exe
    - adinsight.exe
    - adinsight64.exe
    - adrestore.exe
    - adrestore64.exe
    - autologon.exe
    - autologon64.exe
    - autoruns.exe
    - autoruns64.exe
    - autorunsc.exe
    - autorunsc64.exe
    - bginfo.exe
    - bginfo64.exe
    - cacheset.exe
    - cacheset64.exe
    - ciscocollabhost.exe
    - clockres.exe
    - clockres64.exe
    - contig.exe
    - contig64.exe
    - coreinfo.exe
    - coreinfo64.exe
    - cpustres.exe
    - cpustres64.exe
    - ctrl2cap.exe
    - dbgview.exe
    - dbgview64.exe
    - desktops.exe
    - desktops64.exe
    - disk2vhd.exe
    - disk2vhd64.exe
    - diskext.exe
    - diskext64.exe
    - diskmon.exe
    - diskmon64.exe
    - diskview.exe
    - diskview64.exe
    - du.exe
    - du64.exe
    - efsdump.exe
    - findlinks.exe
    - findlinks64.exe
    - handle.exe
    - handle64.exe
    - hex2dec.exe
    - hex2dec64.exe
    - junction.exe
    - junction64.exe
    - ldmdump.exe
    - listdlls.exe
    - listdlls64.exe
    - livekd.exe
    - livekd64.exe
    - loadord.exe
    - loadord64.exe
    - loadordc.exe
    - loadordc64.exe
    - logonsessions.exe
    - logonsessions64.exe
    - movefile.exe
    - movefile64.exe
    - notmyfault.exe
    - notmyfault64.exe
    - notmyfaultc.exe
    - notmyfaultc64.exe
    - ntfsinfo.exe
    - ntfsinfo64.exe
    - pendmoves.exe
    - pendmoves64.exe
    - pipelist.exe
    - pipelist64.exe
    - portmon.exe
    - procdump.exe
    - procdump64.exe
    - procexp.exe
    - procexp64.exe
    - procmon.exe
    - procmon64.exe
    - psexec.exe
    - psexec64.exe
    - psfile.exe
    - psfile64.exe
    - psgetsid.exe
    - psgetsid64.exe
    - psinfo.exe
    - psinfo64.exe
    - pskill.exe
    - pskill64.exe
    - pslist.exe
    - pslist64.exe
    - psloggedon.exe
    - psloggedon64.exe
    - psloglist.exe
    - psloglist64.exe
    - pspasswd.exe
    - pspasswd64.exe
    - psping.exe
    - psping64.exe
    - psservice.exe
    - psservice64.exe
    - psshutdown.exe
    - psshutdown64.exe
    - pssuspend.exe
    - pssuspend64.exe
    - rammap.exe
    - rammap64.exe
    - rdcman.exe
    - reg.exe
    - regdelnull.exe
    - regdelnull64.exe
    - reghide.exe
    - regjump.exe
    - rootkitrevealer.exe
    - ru.exe
    - ru64.exe
    - sdelete.exe
    - sdelete64.exe
    - setuprst.exe
    - shareenum.exe
    - shareenum64.exe
    - shellrunas.exe
    - sigcheck.exe
    - sigcheck64.exe
    - streams.exe
    - streams64.exe
    - strings.exe
    - strings64.exe
    - sync.exe
    - sync64.exe
    - sysmon.exe
    - sysmon64.exe
    - tcpvcon.exe
    - tcpvcon64.exe
    - tcpview.exe
    - tcpview64.exe
    - testlimit.exe
    - testlimit64.exe
    - vmmap.exe
    - vmmap64.exe
    - volumeid.exe
    - volumeid64.exe
    - whois.exe
    - whois64.exe
    - winobj.exe
    - winobj64.exe
    - zoomit.exe
    - zoomit64.exe
    - accepteula=1
condition: legit_commandline and not filter