New Application First Execution in AppCompat
This rule detects the creation of new entries in the AppCompatFlags\Compatibility Assistant\Store registry key. This key is used by Windows to track applications that have been executed for the first time on an endpoint. This detection can indicate the introduction and initial execution of new software, which could be legitimate or malicious.
Sigma
