{"id":"T1546.011","name":"Application Shimming","url":"https://attack.mitre.org/techniques/T1546/011","tactics":["privilege-escalation","persistence"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0017","stix_id":"x-mitre-detection-strategy--22fe898e-3b53-468c-b2b2-dd59abc83297","name":"Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0017","analytics":[{"id":"AN0051","stix_id":"x-mitre-analytic--8fcdd234-c8d8-4d95-b381-91c92cb319b6","name":"Analytic 0051","description":"Correlated modification of AppCompat registry keys and execution of sdbinst.exe to install custom shim databases. Followed by DLL injection via shim behavior into target application processes.","url":"https://attack.mitre.org/detectionstrategies/DET0017#AN0051","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CustomShimPathAllowlist","description":"Filter out known-good .sdb paths in AppPatch\\Custom folders"},{"field":"TimeWindow","description":"Tunable window for correlating registry modification and sdbinst.exe execution"},{"field":"DLLInjectionTarget","description":"Expected target applications or binaries for injected DLLs"},{"field":"UserContext","description":"Limit alerting to admin or SYSTEM-context initiated shim installations"},{"field":"ShimCommandLinePattern","description":"Expected or benign sdbinst.exe command-line patterns to exclude"}],"live":true,"detection_strategies":["DET0017"],"techniques":["T1546.011"]}],"live":true,"version":"1.0","techniques":["T1546.011"]}],"sigma_rules":[{"id":"18ee686c-38a3-4f65-9f44-48a077141f42","title":"Uncommon Extension Shim Database Installation Via Sdbinst.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-01","modified":"2024-01-10","description":"Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\n","references":["https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html","https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1546.011"],"path":"rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml","techniques":["T1546.011"],"cves":[]},{"id":"517490a7-115a-48c6-8862-1a481504d5a8","title":"Potential Shim Database Persistence via Sdbinst.EXE","author":"Markus Neis","status":"test","level":"medium","date":"2019-01-16","modified":"2023-12-06","description":"Detects installation of a new shim using sdbinst.exe.\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\n","references":["https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1546.011"],"path":"rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml","techniques":["T1546.011"],"cves":[]},{"id":"6b6976a3-b0e6-4723-ac24-ae38a737af41","title":"Potential Persistence Via Shim Database In Uncommon Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-01","modified":"2023-08-17","description":"Detects the installation of a new shim database where the file is located in a non-default location","references":["https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html","https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/","https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.011"],"path":"rules/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml","techniques":["T1546.011"],"cves":[]},{"id":"b86852fb-4c77-48f9-8519-eb1b2c308b59","title":"Potential Persistence Via AppCompat RegisterAppRestart Layer","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-01-01","modified":null,"description":"Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.\nThis compatibility layer allows an application to register for restart using the \"RegisterApplicationRestart\" API.\nThis can be potentially abused as a persistence mechanism.\n","references":["https://github.com/nasbench/Misc-Research/blob/d114d6a5e0a437d3818e492ef9864367152543e7/Other/Persistence-Via-RegisterAppRestart-Shim.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.011"],"path":"rules/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml","techniques":["T1546.011"],"cves":[]},{"id":"bf344fea-d947-4ef4-9192-34d008315d3a","title":"Suspicious Shim Database Patching Activity","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-01","modified":"2023-12-06","description":"Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/","https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.011"],"path":"rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml","techniques":["T1546.011"],"cves":[]},{"id":"dfb5b4e8-91d0-4291-b40a-e3b0d3942c45","title":"Potential Persistence Via Shim Database Modification","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":"2025-10-22","description":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.\nThe Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-3---registry-key-creation-andor-modification-events-for-sdb","https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html","https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1546.011"],"path":"rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml","techniques":["T1546.011"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}