
title: Abusing Windows Telemetry For Persistence
author: Sreeman
date: 2020/09/29
description: Windows telemetry makes use of the binary CompatTelRunner.exe to run
  a variety of commands and perform the actual telemetry collections. This binary
  was created to be easily extensible, and to that end, it relies on the registry
  to instruct on which commands to run. The problem is, it will run any arbitrary
  command without restriction of location or type.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\\*'
  SELECTION_5:
    Details:
    - '*.sh'
    - '*.exe'
    - '*.dll'
    - '*.bin'
    - '*.bat'
    - '*.cmd'
    - '*.js'
    - '*.ps'
    - '*.vb'
    - '*.jar'
    - '*.hta'
    - '*.msi'
    - '*.vbs'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5)
falsepositives:
- none
fields:
- EventID
- CommandLine
- TargetObject
- Details
id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5
level: high
logsource:
  category: registry_event
  product: windows
modified: 2021/09/24
references:
- https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
status: experimental
tags:
- attack.defense_evasion
- attack.persistence
- attack.t1112
- attack.t1053
ruletype: SIGMA
