Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Potential Persistence Via Microsoft Compatibility Appraiser

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
SreemanCreated Tue Sep 29Updated Fri Feb 10f548a603-c9f2-4c89-b511-b089f7e94549windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'run '
            - '\Application Experience\Microsoft Compatibility Appraiser'
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
trustedsec.com
MITRE ATT&CK
Related Rules
DerivedDetectionhigh

Potential Registry Persistence Attempt Via Windows Telemetry

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
f548a603-c9f2-4c89-b511-b089f7e94549
Status
test
Level
medium
Type
Detection
Created
Tue Sep 29
Modified
Fri Feb 10
Author
Sreeman
Path
rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml
Raw Tags
attack.privilege-escalationattack.executionattack.persistenceattack.t1053.005
View on GitHub