kevmap

Techniques › T1546 › T1546.011

T1546.011 Application Shimming

privilege escalation · persistence — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
6
Sigma rules tagged attack.t1546.011
0
KEV CVEs mapped here
<p>Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.</p><p>Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.</p><p>A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:</p>
    <li><code>%WINDIR%\AppPatch\sysmain.sdb</code> and</li><li><code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb</code></li>
<p>Custom databases are stored in:</p>
    <li><code>%WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom</code> and</li><li><code>hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom</code></li>
<p>To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to Bypass User Account Control (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).</p><p>Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. Shims can also be abused to establish persistence by continuously being invoked by affected programs.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.011

Uncommon Extension Shim Database Installation Via Sdbinst.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-01 (modified 2024-01-10) · logsource: product=windows category=process_creation · 18ee686c-38a3-4f65-9f44-48a077141f42
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Techniques: T1546.011
Potential Shim Database Persistence via Sdbinst.EXE mediumtest
Author: Markus Neis · 2019-01-16 (modified 2023-12-06) · logsource: product=windows category=process_creation · 517490a7-115a-48c6-8862-1a481504d5a8
Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Techniques: T1546.011
Potential Persistence Via Shim Database In Uncommon Location hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · 6b6976a3-b0e6-4723-ac24-ae38a737af41
Detects the installation of a new shim database where the file is located in a non-default location
Techniques: T1546.011
Potential Persistence Via AppCompat RegisterAppRestart Layer mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2024-01-01 · logsource: product=windows category=registry_set · b86852fb-4c77-48f9-8519-eb1b2c308b59
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Techniques: T1546.011
Suspicious Shim Database Patching Activity hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-01 (modified 2023-12-06) · logsource: product=windows category=registry_set · bf344fea-d947-4ef4-9192-34d008315d3a
Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.
Techniques: T1546.011
Potential Persistence Via Shim Database Modification mediumtest
Author: frack113 · 2021-12-30 (modified 2025-10-22) · logsource: product=windows category=registry_set · dfb5b4e8-91d0-4291-b40a-e3b0d3942c45
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time
Techniques: T1546.011

Rules tagged at the parent level (attack.t1546) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

COM Hijack via Sdclt hightest
Author: Omkar Gudhate · 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Techniques: T1546T1548
Control Panel Items hightest
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Techniques: T1218.002T1546
Suspicious Get-Variable.exe Creation hightest
Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Techniques: T1546T1027
Suspicious Outlook Macro Created hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Techniques: T1137T1008T1546
MSSQL Extended Stored Procedure Backdoor Maggie hightest
Author: Denis Szadkowski, DIRT / DCSO CyTec · 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Techniques: T1546
SOURGUM Actor Behaviours hightest
Author: MSTIC, FPT.EagleEye · 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Techniques: T1546T1546.015
New Outlook Macro Created mediumtest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
HAFNIUM Exchange Exploitation Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Techniques: T1546T1053
Outlook Macro Execution Without Warning Setting Enabled hightest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Techniques: T1137T1008T1546