Windows: Manual persistence attempt using schtasks to run Microsoft Compatibility Appraiser

title: "Windows: Manual persistence attempt using schtasks to run Microsoft Compatibility Appraiser"
id: 746e89bb-dc0b-4d9c-b493-bfeea6dd07fb
related:
  - id: 73a883d0-0348-4be4-a8d8-51031c2564f8
    type: derived
  - id: f548a603-c9f2-4c89-b511-b089f7e94549
    type: derived
status: test
description: This rule flags process creation where schtasks.exe is executed with a command line that includes running the "Application Experience\Microsoft Compatibility Appraiser" task. Attackers may abuse this task execution path to establish persistence tied to the "\AppCompatFlags\TelemetryController" registry location. The detection relies on Windows process creation telemetry capturing the executable name and full command line parameters.
references:
  - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml
author: Sreeman, Huntrule Team
date: 2020-09-29
modified: 2023-02-10
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_cli:
    CommandLine|contains|all:
      - "run "
      - \Application Experience\Microsoft Compatibility Appraiser
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1