LoFP / this rule is to explore new applications on an endpoint. false positives depends on the organization.

Techniques

• t1204
• t1204.002

Sample rules

New Application in AppCompat

• source: sigma
• technicques:
  • t1204
  • t1204.002

Description

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Detection logic

condition: selection
selection:
  TargetObject|contains: \AppCompatFlags\Compatibility Assistant\Store\