Abusing Windows Telemetry for Persistence

This report describes a persistence technique that leverages the Windows CompatTelRunner.exe telemetry controller by adding keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController to run arbitrary executables as SYSTEM on client Windows versions; it explains configuration steps, internal run modes/validation, command invocation, and defensive implications (not visible in autoruns and requires monitoring of this registry area).