Application Shimming

let SdbInstall = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sdbinst.exe"
| extend SdbFile = extract(@"sdbinst\.exe\s+(?:[-/][^\s]+\s+)*([\S]+\.sdb)", 1, ProcessCommandLine)
| extend IsUninstall = ProcessCommandLine has "-u"
| project SdbTime=Timestamp, DeviceName, AccountName, ProcessCommandLine,
         SdbFile, IsUninstall, InitiatingProcessFileName;
let SdbRegistry = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom",
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB"
  )
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| project RegTime=Timestamp, DeviceName, AccountName, RegistryKey,
         RegistryValueName, RegistryValueData, InitiatingProcessFileName;
let SdbFiles = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".sdb"
| where FolderPath !has "C:\\Windows\\AppPatch\\"
| where ActionType in ("FileCreated", "FileModified")
| project FileTime=Timestamp, DeviceName, AccountName, FileName, FolderPath, ActionType;
union (SdbInstall | extend EventType="SDB_INSTALL"),
      (SdbRegistry | extend EventType="SDB_REGISTRY"),
      (SdbFiles | extend EventType="SDB_FILE_CREATED")
| sort by SdbTime desc, RegTime desc, FileTime desc

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval IsSdbInstall=if(
    (EventCode=1 OR EventCode=4688)
    AND match(lower(coalesce(Image, NewProcessName, "")), "sdbinst\.exe"),
    1, 0
  )
| eval IsAppCompatReg=if(
    (EventCode=12 OR EventCode=13)
    AND match(TargetObject, "AppCompatFlags\\\\(Custom|InstalledSDB)"),
    1, 0
  )
| eval IsSdbFile=if(
    EventCode=11
    AND match(lower(TargetFilename), "\.sdb$")
    AND NOT match(TargetFilename, "(?i)windows\\\\apppatch"),
    1, 0
  )
| where IsSdbInstall=1 OR IsAppCompatReg=1 OR IsSdbFile=1
| eval DetectionType=case(
    IsSdbInstall=1, "SDB_INSTALLER_EXECUTED",
    IsAppCompatReg=1, "APPCOMPAT_REGISTRY_MODIFIED",
    IsSdbFile=1, "SDB_FILE_CREATED",
    1=1, "UNKNOWN"
  )
| eval RiskLevel=case(
    IsSdbInstall=1 AND NOT (Image="*\\msiexec.exe" OR Image="*\\setup.exe"), "HIGH",
    IsAppCompatReg=1, "HIGH",
    IsSdbFile=1, "MEDIUM",
    1=1, "LOW"
  )
| table _time, host, User, EventCode, DetectionType, RiskLevel, TargetObject, Details, Image, CommandLine, TargetFilename
| sort - _time

sequence by host.name with maxspan=5m
  [any where
    (event.category == "process" and process.name : "sdbinst.exe") or
    (event.category == "registry" and registry.path : ("*\\AppCompatFlags\\Custom\\*", "*\\AppCompatFlags\\InstalledSDB\\*") and event.type in ("creation", "change")) or
    (event.category == "file" and file.extension == "sdb" and not file.path : "C:\\Windows\\AppPatch\\*" and event.type in ("creation", "change"))
  ]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  QIDNAME(qid) AS event_name,
  "Process Name",
  "Command",
  "File Name",
  "File Path",
  "Registry Key",
  "Registry Value",
  CASE
    WHEN LOWER("Process Name") LIKE '%sdbinst.exe%' THEN 'SDB_INSTALLER_EXECUTED'
    WHEN "Registry Key" LIKE '%AppCompatFlags%Custom%' OR "Registry Key" LIKE '%AppCompatFlags%InstalledSDB%' THEN 'APPCOMPAT_REGISTRY_MODIFIED'
    WHEN LOWER("File Name") LIKE '%.sdb' AND "File Path" NOT LIKE '%Windows%AppPatch%' THEN 'SDB_FILE_CREATED'
    ELSE 'UNKNOWN'
  END AS detection_type,
  CASE
    WHEN LOWER("Process Name") LIKE '%sdbinst.exe%' AND "Process Name" NOT LIKE '%msiexec%' AND "Process Name" NOT LIKE '%setup%' THEN 'HIGH'
    WHEN "Registry Key" LIKE '%AppCompatFlags%' THEN 'HIGH'
    WHEN LOWER("File Name") LIKE '%.sdb' THEN 'MEDIUM'
    ELSE 'LOW'
  END AS risk_level
FROM events
WHERE
  devicetime > (NOW() - 86400000)
  AND (
    LOWER("Process Name") LIKE '%sdbinst.exe%'
    OR ("Registry Key" LIKE '%AppCompatFlags%Custom%' OR "Registry Key" LIKE '%AppCompatFlags%InstalledSDB%')
    OR (LOWER("File Name") LIKE '%.sdb' AND "File Path" NOT LIKE '%Windows%AppPatch%')
  )
ORDER BY devicetime DESC

_sourceCategory=windows* (sdbinst.exe OR AppCompatFlags OR ".sdb")
| parse "EventCode=*" as event_code nodrop
| parse "Image=*" as image nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "TargetFilename=*" as target_filename nodrop
| parse "TargetObject=*" as registry_key nodrop
| parse "Details=*" as registry_details nodrop
| parse "User=*" as user nodrop
| where (
    (event_code in ("1", "4688") and matches(toLowerCase(image), ".*sdbinst\\.exe.*"))
    or (event_code in ("12", "13") and matches(registry_key, ".*AppCompatFlags.*(Custom|InstalledSDB).*"))
    or (event_code = "11" and matches(toLowerCase(target_filename), ".*\\.sdb$") and !matches(target_filename, "(?i).*windows\\\\apppatch.*"))
  )
| eval detection_type = if(matches(toLowerCase(image), ".*sdbinst\\.exe.*"), "SDB_INSTALLER_EXECUTED",
    if(matches(registry_key, ".*AppCompatFlags.*"), "APPCOMPAT_REGISTRY_MODIFIED",
    if(matches(toLowerCase(target_filename), ".*\\.sdb$"), "SDB_FILE_CREATED", "UNKNOWN")))
| eval risk_level = if(matches(toLowerCase(image), ".*sdbinst\\.exe.*") and !matches(image, "(?i).*(msiexec|setup)\\.exe.*"), "HIGH",
    if(matches(registry_key, ".*AppCompatFlags.*"), "HIGH",
    if(matches(toLowerCase(target_filename), ".*\\.sdb$"), "MEDIUM", "LOW")))
| table _messageTime, _sourceHost, user, event_code, detection_type, risk_level, image, command_line, registry_key, registry_details, target_filename
| sort by _messageTime desc

rule application_shimming_t1546_011 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Application Shimming (T1546.011) via sdbinst.exe execution, AppCompatFlags registry modification, or .sdb file creation outside Windows AppPatch"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1546.011"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-20"

  events:
    (
      // sdbinst.exe process execution
      ($e.metadata.event_type = "PROCESS_LAUNCH" and
       re.regex($e.target.process.file.full_path, `(?i)sdbinst\.exe$`))
      or
      // AppCompatFlags registry modification
      ($e.metadata.event_type = "REGISTRY_MODIFICATION" and
       (
         re.regex($e.target.registry.registry_key, `(?i)AppCompatFlags\\(Custom|InstalledSDB)`) or
         re.regex($e.target.registry.registry_key, `(?i)AppCompatFlags.*(Custom|InstalledSDB)`)
       ))
      or
      // .sdb file created outside Windows AppPatch
      ($e.metadata.event_type = "FILE_CREATION" and
       re.regex($e.target.file.full_path, `(?i)\.sdb$`) and
       not re.regex($e.target.file.full_path, `(?i)Windows\\AppPatch`))
    )

  condition:
    $e
}

// Application Shimming Detection — T1546.011
// Detect sdbinst.exe execution, AppCompatFlags registry modifications, and .sdb file creation
(
  // sdbinst.exe process execution
  (#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2)
  | regex(field=ImageFileName, regex="(?i)sdbinst\\.exe$")
  | eval DetectionType="SDB_INSTALLER_EXECUTED"
  | eval RiskLevel=if(match(ParentBaseFileName, "(?i)(msiexec|setup)\\.exe"), "MEDIUM", "HIGH")
)
| union (
  // AppCompatFlags registry key modification
  (#event_simpleName=RegSetValue OR #event_simpleName=RegCreateKey)
  | regex(field=RegObjectName, regex="(?i)AppCompatFlags\\\\(Custom|InstalledSDB)")
  | eval DetectionType="APPCOMPAT_REGISTRY_MODIFIED"
  | eval RiskLevel="HIGH"
)
| union (
  // .sdb file creation outside Windows AppPatch
  #event_simpleName=PeFileWritten
  | regex(field=TargetFileName, regex="(?i)\\.sdb$")
  | not regex(field=TargetFileName, regex="(?i)Windows\\\\AppPatch")
  | eval DetectionType="SDB_FILE_CREATED"
  | eval RiskLevel="MEDIUM"
)
| groupBy([ComputerName, UserName, DetectionType, RiskLevel, ImageFileName, CommandLine, RegObjectName, TargetFileName], function=count(as=EventCount))
| sort(field=EventCount, order=desc)