huntrule

Windows: Manual persistence attempt using schtasks to run Microsoft Compatibility Appraiser

Alerts when schtasks runs "Microsoft Compatibility Appraiser" via Application Experience, consistent with persistence abuse.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Sreeman (SigmaHQ), DRL 1.1
Published
2020-09-29
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where schtasks.exe is executed with a command line that includes running the "Application Experience\Microsoft Compatibility Appraiser" task. Attackers may abuse this task execution path to establish persistence tied to the "\AppCompatFlags\TelemetryController" registry location. The detection relies on Windows process creation telemetry capturing the executable name and full command line parameters.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Named WindowsHelper (via process_creation)
Scheduled Task Masquerading as Microsoft Wininet Config
Suspicious SYSTEM Scheduled Task Named test Created via schtasks
Suspicious Scheduled Task Created by Windows Script Host
Malicious CloudZ RAT Persistence via schtasks Running regasm.exe
Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244
Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell
Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware
Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)
Windows: Manual persistence attempt using schtasks to run Microsoft Compatibility Appraiser
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.