Potential Registry Persistence Attempt Via Windows Telemetry

calendar Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005  ·
Share on: linkedin copy

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Sigma rule (View on GitHub)

 1title: Potential Registry Persistence Attempt Via Windows Telemetry
 2id: 73a883d0-0348-4be4-a8d8-51031c2564f8
 3related:
 4    - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5
 5      type: obsolete
 6status: test
 7description: |
 8    Detects potential persistence behavior using the windows telemetry registry key.
 9    Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
10    This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
11    The problem is, it will run any arbitrary command without restriction of location or type.    
12references:
13    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
14author: Lednyov Alexey, oscd.community, Sreeman
15date: 2020-10-16
16modified: 2023-08-17
17tags:
18    - attack.privilege-escalation
19    - attack.execution
20    - attack.persistence
21    - attack.t1053.005
22logsource:
23    category: registry_set
24    product: windows
25    definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives'
26detection:
27    selection:
28        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\'
29        TargetObject|endswith: '\Command'
30        Details|contains:
31            - '.bat'
32            - '.bin'
33            - '.cmd'
34            - '.dat'
35            - '.dll'
36            - '.exe'
37            - '.hta'
38            - '.jar'
39            - '.js'
40            - '.msi'
41            - '.ps'
42            - '.sh'
43            - '.vb'
44    filter_main_generic:
45        Details|contains:
46            - '\system32\CompatTelRunner.exe'
47            - '\system32\DeviceCensus.exe'
48    condition: selection and not 1 of filter_main_*
49falsepositives:
50    - Unknown
51level: high

References

Related rules

to-top