newly setup system.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml>sigma
technicques: t1204 t1204.002

Techniques

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

condition: selection
selection:
  TargetObject|contains: \AppCompatFlags\Compatibility Assistant\Store\