New Application in AppCompat

Title: New Application in AppCompat
Status: test
Description:A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/1
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/1.A.1_DFD6A782-9BDB-4550-AB6B-525E825B095E.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2023-08-17
Tags:

• -'attack.execution'
• -'attack.t1204.002'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains: '\AppCompatFlags\Compatibility Assistant\Store\'
  condition:selection
Falsepositives:
  -This rule is to explore new applications on an endpoint. False positives depends on the organization.
  -Newly setup system.
  -Legitimate installation of new application.
Level: informational