Potential Persistence Via Microsoft Compatibility Appraiser

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.