Detect Application Shimming in Splunk
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. The SDB (Shim DataBase) stores fix entries and shims. Malicious shim databases can be installed by adversaries using sdbinst.exe. Custom shims can be written to intercept and redirect API calls to inject malicious code into otherwise legitimate processes. This allows adversaries to apply persistent fixes to legitimate applications that execute when those applications run.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.011 Application Shimming
- Canonical reference
- https://attack.mitre.org/techniques/T1546/011/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval IsSdbInstall=if(
(EventCode=1 OR EventCode=4688)
AND match(lower(coalesce(Image, NewProcessName, "")), "sdbinst\.exe"),
1, 0
)
| eval IsAppCompatReg=if(
(EventCode=12 OR EventCode=13)
AND match(TargetObject, "AppCompatFlags\\\\(Custom|InstalledSDB)"),
1, 0
)
| eval IsSdbFile=if(
EventCode=11
AND match(lower(TargetFilename), "\.sdb$")
AND NOT match(TargetFilename, "(?i)windows\\\\apppatch"),
1, 0
)
| where IsSdbInstall=1 OR IsAppCompatReg=1 OR IsSdbFile=1
| eval DetectionType=case(
IsSdbInstall=1, "SDB_INSTALLER_EXECUTED",
IsAppCompatReg=1, "APPCOMPAT_REGISTRY_MODIFIED",
IsSdbFile=1, "SDB_FILE_CREATED",
1=1, "UNKNOWN"
)
| eval RiskLevel=case(
IsSdbInstall=1 AND NOT (Image="*\\msiexec.exe" OR Image="*\\setup.exe"), "HIGH",
IsAppCompatReg=1, "HIGH",
IsSdbFile=1, "MEDIUM",
1=1, "LOW"
)
| table _time, host, User, EventCode, DetectionType, RiskLevel, TargetObject, Details, Image, CommandLine, TargetFilename
| sort - _timeDetects shim installation via Sysmon process creation, registry modification, and file creation events. Sdbinst.exe execution outside of known installer contexts (msiexec.exe, setup.exe parents) is flagged as HIGH risk. AppCompatFlags registry modifications are always flagged. .sdb file creation outside the Windows AppPatch directory is flagged as MEDIUM risk. The combination of multiple signals in a short time window significantly increases confidence.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Application installers using sdbinst.exe for compatibility shims
- Group Policy or SCCM-deployed compatibility databases
- Software vendors including shims in installers
- Windows ADK users creating compatibility fixes
Other platforms for T1546.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install Custom Shim Database with sdbinst.exe
Expected signal: Process creation for sdbinst.exe with the SDB file path argument. File creation event for argus_test.sdb in Temp directory. Registry modification to AppCompatFlags\InstalledSDB adding a new GUID key. Process creation event for sdbinst.exe is the primary detection trigger.
- Test 2Query Installed Shim Databases
Expected signal: Process creation for reg.exe querying AppCompatFlags keys. Read-only operation. Output shows all installed SDB GUIDs and their file paths.
- Test 3Create Shim Database File Outside AppPatch
Expected signal: File creation event (Sysmon 11): TargetFilename ends with .sdb and path contains Temp, not Windows\AppPatch. This triggers the SDB_FILE_CREATED detection vector.
References (6)
- https://attack.mitre.org/techniques/T1546/011/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.011.md
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://www.mandiant.com/resources/blog/fin7-duos-duplicitous-scheme
- https://www.alex-ionescu.com/?p=39
- https://github.com/mandiant/ShimCacheParser
Unlock Pro Content
Get the full detection package for T1546.011 including response playbook, investigation guide, and atomic red team tests.