Sigma rule: Abusing Windows Telemetry For Persistence - Registry

Rule

Title

Abusing Windows Telemetry For Persistence - Registry

Status

deprecated

Level

high

Author

Sreeman

Date

2020/09/29

Modified

2023/08/17

File

deprecated/windows/registry_set_abusing_windows_telemetry_for_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
The problem is, it will run any arbitrary command without restriction of location or type.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\'
    Details|endswith:
        - '.sh'
        - '.exe'
        - '.dll'
        - '.bin'
        - '.bat'
        - '.cmd'
        - '.js'
        - '.ps'
        - '.vb'
        - '.jar'
        - '.hta'
        - '.msi'
        - '.vbs'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense_evasion
• attack.persistence
• attack.t1112
• attack.t1053

MITRE ATT&CK ids this rule names

• T1053
• T1112

References

• https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/registry_set_abusing_windows_telemetry_for_persistence.yml