Potential Persistence Via Microsoft Compatibility Appraiser Scheduled Task

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.