
title: Registry Persistence Mechanism via Windows Telemetry
author: Lednyov Alexey, oscd.community
date: 2020/10/16
description: Detects persistence method using windows telemetry
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\\*'
  SELECTION_5:
    TargetObject: '*\Command*'
  SELECTION_6:
    Details: '*.exe*'
  SELECTION_7:
    Details:
    - '*\system32\CompatTelRunner.exe*'
    - '*\system32\DeviceCensus.exe*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and (SELECTION_4 and SELECTION_5
    and SELECTION_6) and  not (SELECTION_7))
falsepositives:
- unknown
id: 73a883d0-0348-4be4-a8d8-51031c2564f8
level: critical
logsource:
  category: registry_event
  definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows
    NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLU hives'
  product: windows
references:
- https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
status: experimental
tags:
- attack.persistence
- attack.t1053.005
ruletype: SIGMA
