{"id":"f548a603-c9f2-4c89-b511-b089f7e94549","title":"Potential Persistence Via Microsoft Compatibility Appraiser","description":"Detects manual execution of the \"Microsoft Compatibility Appraiser\" task via schtasks.\nIn order to trigger persistence stored in the \"\\AppCompatFlags\\TelemetryController\" registry key.\n","author":"Sreeman","status":"test","level":"medium","date":"2020-09-29","modified":"2023-02-10","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005"],"technique_ids":["T1053.005"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/"],"source_path":"rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml","source_sha256":"5ee223d16b9e1c010b14cd9f1637a144259026ded05c2f2633b8d38c1fe4fefa","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via Microsoft Compatibility Appraiser\nid: f548a603-c9f2-4c89-b511-b089f7e94549\nrelated:\n    - id: 73a883d0-0348-4be4-a8d8-51031c2564f8\n      type: derived\nstatus: test\ndescription: |\n    Detects manual execution of the \"Microsoft Compatibility Appraiser\" task via schtasks.\n    In order to trigger persistence stored in the \"\\AppCompatFlags\\TelemetryController\" registry key.\nreferences:\n    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/\nauthor: Sreeman\ndate: 2020-09-29\nmodified: 2023-02-10\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.t1053.005\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'run '\n            - '\\Application Experience\\Microsoft Compatibility Appraiser'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053.005","id":"T1053.005","name":"Scheduled Task","page":"techniques/enterprise/T1053.005/"}],"data_path":"data/detection-rules/f548a603-c9f2-4c89-b511-b089f7e94549.json","kind":"sigma"}