Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Compatibility Telemetry Tampering Through Registry

This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.

ATT&CK coverage

Execution

T1053Scheduled Task/JobAlso under Persistence and Privilege Escalation.
- T1053.005Scheduled Task 74 detections cover this technique

Persistence

T1546Event Triggered ExecutionAlso under Privilege Escalation.78 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_13

What the source says

What fires this without an attack behind it

No false positives have been identified at this time.

References

Tagged by the source as

Windows Persistence TechniquesEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.