Detect Application Shimming in Sumo Logic CSE
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. The SDB (Shim DataBase) stores fix entries and shims. Malicious shim databases can be installed by adversaries using sdbinst.exe. Custom shims can be written to intercept and redirect API calls to inject malicious code into otherwise legitimate processes. This allows adversaries to apply persistent fixes to legitimate applications that execute when those applications run.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.011 Application Shimming
- Canonical reference
- https://attack.mitre.org/techniques/T1546/011/
Sumo Detection Query
_sourceCategory=windows* (sdbinst.exe OR AppCompatFlags OR ".sdb")
| parse "EventCode=*" as event_code nodrop
| parse "Image=*" as image nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "TargetFilename=*" as target_filename nodrop
| parse "TargetObject=*" as registry_key nodrop
| parse "Details=*" as registry_details nodrop
| parse "User=*" as user nodrop
| where (
(event_code in ("1", "4688") and matches(toLowerCase(image), ".*sdbinst\\.exe.*"))
or (event_code in ("12", "13") and matches(registry_key, ".*AppCompatFlags.*(Custom|InstalledSDB).*"))
or (event_code = "11" and matches(toLowerCase(target_filename), ".*\\.sdb$") and !matches(target_filename, "(?i).*windows\\\\apppatch.*"))
)
| eval detection_type = if(matches(toLowerCase(image), ".*sdbinst\\.exe.*"), "SDB_INSTALLER_EXECUTED",
if(matches(registry_key, ".*AppCompatFlags.*"), "APPCOMPAT_REGISTRY_MODIFIED",
if(matches(toLowerCase(target_filename), ".*\\.sdb$"), "SDB_FILE_CREATED", "UNKNOWN")))
| eval risk_level = if(matches(toLowerCase(image), ".*sdbinst\\.exe.*") and !matches(image, "(?i).*(msiexec|setup)\\.exe.*"), "HIGH",
if(matches(registry_key, ".*AppCompatFlags.*"), "HIGH",
if(matches(toLowerCase(target_filename), ".*\\.sdb$"), "MEDIUM", "LOW")))
| table _messageTime, _sourceHost, user, event_code, detection_type, risk_level, image, command_line, registry_key, registry_details, target_filename
| sort by _messageTime descSumo Logic query detecting Application Shimming (T1546.011) across Sysmon and Windows Security logs by identifying sdbinst.exe execution, AppCompatFlags registry modifications, and suspicious .sdb file creation outside the Windows AppPatch directory.
Data Sources
Required Tables
False Positives & Tuning
- Automated software deployment systems (e.g., SCCM, Intune, or Ansible) that apply application compatibility shims during operating system upgrades or application migrations will generate matching events at scale.
- Security researchers or red teamers in authorized penetration testing exercises may execute sdbinst.exe with custom shim databases as part of documented adversary simulation activities.
- Some legitimate antivirus or endpoint detection products use shim databases internally as part of their hooking or monitoring mechanisms, creating AppCompatFlags registry entries during installation.
Other platforms for T1546.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install Custom Shim Database with sdbinst.exe
Expected signal: Process creation for sdbinst.exe with the SDB file path argument. File creation event for argus_test.sdb in Temp directory. Registry modification to AppCompatFlags\InstalledSDB adding a new GUID key. Process creation event for sdbinst.exe is the primary detection trigger.
- Test 2Query Installed Shim Databases
Expected signal: Process creation for reg.exe querying AppCompatFlags keys. Read-only operation. Output shows all installed SDB GUIDs and their file paths.
- Test 3Create Shim Database File Outside AppPatch
Expected signal: File creation event (Sysmon 11): TargetFilename ends with .sdb and path contains Temp, not Windows\AppPatch. This triggers the SDB_FILE_CREATED detection vector.
References (6)
- https://attack.mitre.org/techniques/T1546/011/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.011.md
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://www.mandiant.com/resources/blog/fin7-duos-duplicitous-scheme
- https://www.alex-ionescu.com/?p=39
- https://github.com/mandiant/ShimCacheParser
Unlock Pro Content
Get the full detection package for T1546.011 including response playbook, investigation guide, and atomic red team tests.