Potential Persistence Via Microsoft Compatibility Appraiser

Title: Potential Persistence Via Microsoft Compatibility Appraiser
Status: test
Description:Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
References:
  -https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
Author: Sreeman
Date: 2020-09-29
modified:2023-02-10
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\schtasks.exe' OriginalFileName:'schtasks.exe'   selection_cli:
    CommandLine|contains|all:
      -'run '
      -'\Application Experience\Microsoft Compatibility Appraiser'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium