Detection rules › Sigma

Potential Registry Persistence Attempt Via Windows Telemetry

Severity
high
Author
Lednyov Alexey, oscd.community, Sreeman
Source
upstream

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection

or:
Details|contains: .bat
Details|contains: .bin
Details|contains: .cmd
Details|contains: .dat
Details|contains: .dll
Details|contains: .exe
Details|contains: .hta
Details|contains: .jar
Details|contains: .js
Details|contains: .msi
Details|contains: .ps
Details|contains: .sh
Details|contains: .vb
TargetObject|endswith: '\Command'
TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\'

Stage 2: not 1 of filter_main_generic

or:
Details|contains: '\system32\CompatTelRunner.exe'
Details|contains: '\system32\DeviceCensus.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • .bat corpus 2 (sigma 2)
  • .bin
  • .cmd
  • .dat
  • .dll corpus 3 (sigma 3)
  • .exe corpus 2 (sigma 2)
  • .hta corpus 2 (sigma 2)
  • .jar
  • .js
  • .msi
  • .ps
  • .sh
  • .vb
  • \system32\CompatTelRunner.exe
  • \system32\DeviceCensus.exe
TargetObjectends_with
  • \Command
TargetObjectmatch
  • \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\