Detect Application Shimming in IBM QRadar
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. The SDB (Shim DataBase) stores fix entries and shims. Malicious shim databases can be installed by adversaries using sdbinst.exe. Custom shims can be written to intercept and redirect API calls to inject malicious code into otherwise legitimate processes. This allows adversaries to apply persistent fixes to legitimate applications that execute when those applications run.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.011 Application Shimming
- Canonical reference
- https://attack.mitre.org/techniques/T1546/011/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
sourceip,
QIDNAME(qid) AS event_name,
"Process Name",
"Command",
"File Name",
"File Path",
"Registry Key",
"Registry Value",
CASE
WHEN LOWER("Process Name") LIKE '%sdbinst.exe%' THEN 'SDB_INSTALLER_EXECUTED'
WHEN "Registry Key" LIKE '%AppCompatFlags%Custom%' OR "Registry Key" LIKE '%AppCompatFlags%InstalledSDB%' THEN 'APPCOMPAT_REGISTRY_MODIFIED'
WHEN LOWER("File Name") LIKE '%.sdb' AND "File Path" NOT LIKE '%Windows%AppPatch%' THEN 'SDB_FILE_CREATED'
ELSE 'UNKNOWN'
END AS detection_type,
CASE
WHEN LOWER("Process Name") LIKE '%sdbinst.exe%' AND "Process Name" NOT LIKE '%msiexec%' AND "Process Name" NOT LIKE '%setup%' THEN 'HIGH'
WHEN "Registry Key" LIKE '%AppCompatFlags%' THEN 'HIGH'
WHEN LOWER("File Name") LIKE '%.sdb' THEN 'MEDIUM'
ELSE 'LOW'
END AS risk_level
FROM events
WHERE
devicetime > (NOW() - 86400000)
AND (
LOWER("Process Name") LIKE '%sdbinst.exe%'
OR ("Registry Key" LIKE '%AppCompatFlags%Custom%' OR "Registry Key" LIKE '%AppCompatFlags%InstalledSDB%')
OR (LOWER("File Name") LIKE '%.sdb' AND "File Path" NOT LIKE '%Windows%AppPatch%')
)
ORDER BY devicetime DESCQRadar AQL query detecting Application Shimming (T1546.011) via sdbinst.exe process execution events, AppCompatFlags registry key modifications, and .sdb shim database file creation outside legitimate Windows AppPatch directories. Covers Windows Security and Sysmon log sources.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise application compatibility testing teams using the Windows ACT (Application Compatibility Toolkit) will regularly invoke sdbinst.exe and write to AppCompatFlags registry keys as part of their normal workflow.
- Third-party software vendors shipping applications built for older Windows versions may bundle their own shim databases and install them via their setup routines, triggering all detection conditions.
- IT administrators running automated deployment scripts that include compatibility patches for legacy line-of-business applications may generate high volumes of these events around patch windows.
Other platforms for T1546.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install Custom Shim Database with sdbinst.exe
Expected signal: Process creation for sdbinst.exe with the SDB file path argument. File creation event for argus_test.sdb in Temp directory. Registry modification to AppCompatFlags\InstalledSDB adding a new GUID key. Process creation event for sdbinst.exe is the primary detection trigger.
- Test 2Query Installed Shim Databases
Expected signal: Process creation for reg.exe querying AppCompatFlags keys. Read-only operation. Output shows all installed SDB GUIDs and their file paths.
- Test 3Create Shim Database File Outside AppPatch
Expected signal: File creation event (Sysmon 11): TargetFilename ends with .sdb and path contains Temp, not Windows\AppPatch. This triggers the SDB_FILE_CREATED detection vector.
References (6)
- https://attack.mitre.org/techniques/T1546/011/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.011.md
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://www.mandiant.com/resources/blog/fin7-duos-duplicitous-scheme
- https://www.alex-ionescu.com/?p=39
- https://github.com/mandiant/ShimCacheParser
Unlock Pro Content
Get the full detection package for T1546.011 including response playbook, investigation guide, and atomic red team tests.