LoFP / legitimate custom shim installations will also trigger this rule

Techniques

• t1546
• t1546.011
• t1547
• t1547.009

Sample rules

New Custom Shim Database Created

• source: sigma
• technicques:
  • t1547
  • t1547.009

Description

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Detection logic

condition: selection
selection:
  TargetFilename|contains:
  - :\Windows\apppatch\Custom\
  - :\Windows\apppatch\CustomSDB\

Potential Persistence Via Shim Database Modification

• source: sigma
• technicques:
  • t1546
  • t1546.011

Description

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Detection logic

condition: selection and not 1 of filter_main_*
filter_main_empty:
  Details: ''
selection:
  TargetObject|contains:
  - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\
  - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\