Potential Registry Persistence Attempt Via Windows Telemetry
Detects potential persistence behavior by monitoring modifications to the Windows TelemetryController registry key. Adversaries can abuse the `CompatTelRunner.exe` binary, which is used by Windows telemetry, to execute arbitrary commands specified in the registry. This rule specifically looks for modifications to the `TelemetryController` subkey where the `Command` value is set to execute common executable file types.
Sigma
