Potential Persistence Via Microsoft Compatibility Appraiser — Detection Rule
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.