Hayabusa informational test sigma

New Application in AppCompat

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

View Source

Detection Logic

{
  "registry_set": {
    "EventID": 13,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetObject
| contains": "\\AppCompatFlags\\Compatibility Assistant\\Store\\"
  },
  "condition": "registry_set and selection"
}

False Positives

  • ⚠ This rule is to explore new applications on an endpoint. False positives depends on the organization.
  • ⚠ Newly setup system.
  • ⚠ Legitimate installation of new application.

Field Validations

Loading…

Comments (0)

Loading comments...