huntrule

Potential Windows Registry Persistence via AppCompatFlags TelemetryController Commands

Flags registry entries under TelemetryController\Command that reference executable/script payloads potentially abusing telemetry for persistence.

FreeUnreviewedSigmahighv1
title: Potential Windows Registry Persistence via AppCompatFlags TelemetryController Commands
id: b6ba1e1e-33f5-4435-9367-63df5674d095
related:
  - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5
    type: obsolete
  - id: 73a883d0-0348-4be4-a8d8-51031c2564f8
    type: derived
status: test
description: This rule identifies registry writes to the AppCompatFlags TelemetryController area where the target command ends with "\Command" and the command details reference executable or script-like file extensions. Attackers can abuse the Windows telemetry workflow that uses CompatTelRunner.exe to execute extensible, registry-driven commands without restricting where the command resides. Detection relies on Sysmon-style registry_set telemetry capturing the TargetObject path and the Details content for the written values, with filtering to exclude specific system telemetry executables.
references:
  - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_telemetry_persistence.yml
author: Lednyov Alexey, oscd.community, Sreeman, Huntrule Team
date: 2020-10-16
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
  definition: "Requirements: Sysmon config that monitors \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController subkey of the HKLM hives"
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\
    TargetObject|endswith: \Command
    Details|contains:
      - .bat
      - .bin
      - .cmd
      - .dat
      - .dll
      - .exe
      - .hta
      - .jar
      - .js
      - .msi
      - .ps
      - .sh
      - .vb
  filter_main_generic:
    Details|contains:
      - \system32\CompatTelRunner.exe
      - \system32\DeviceCensus.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies registry writes to the AppCompatFlags TelemetryController area where the target command ends with "\Command" and the command details reference executable or script-like file extensions. Attackers can abuse the Windows telemetry workflow that uses CompatTelRunner.exe to execute extensible, registry-driven commands without restricting where the command resides. Detection relies on Sysmon-style registry_set telemetry capturing the TargetObject path and the Details content for the written values, with filtering to exclude specific system telemetry executables.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.