Detect Application Shimming in Google Chronicle

rule application_shimming_t1546_011 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Application Shimming (T1546.011) via sdbinst.exe execution, AppCompatFlags registry modification, or .sdb file creation outside Windows AppPatch"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1546.011"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-20"

  events:
    (
      // sdbinst.exe process execution
      ($e.metadata.event_type = "PROCESS_LAUNCH" and
       re.regex($e.target.process.file.full_path, `(?i)sdbinst\.exe$`))
      or
      // AppCompatFlags registry modification
      ($e.metadata.event_type = "REGISTRY_MODIFICATION" and
       (
         re.regex($e.target.registry.registry_key, `(?i)AppCompatFlags\\(Custom|InstalledSDB)`) or
         re.regex($e.target.registry.registry_key, `(?i)AppCompatFlags.*(Custom|InstalledSDB)`)
       ))
      or
      // .sdb file created outside Windows AppPatch
      ($e.metadata.event_type = "FILE_CREATION" and
       re.regex($e.target.file.full_path, `(?i)\.sdb$`) and
       not re.regex($e.target.file.full_path, `(?i)Windows\\AppPatch`))
    )

  condition:
    $e
}