Sub-technique of T1546 Event Triggered Execution.View on attack.mitre.org
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:
* %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb
Custom databases are stored in:
* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom
To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to Bypass User Account Control (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).
Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. Shims can also be abused to establish persistence by continuously being invoked by affected programs.
Rules on DetectionCode tagged with T1546.011.
| Rule | Level | Log source |
|---|---|---|
| Potential Persistence Via Shim Database In Uncommon Location | high | windows / registry_set |
| Suspicious Shim Database Patching Activity | high | windows / registry_set |
| Potential Persistence Via AppCompat RegisterAppRestart Layer | medium | windows / registry_set |
| Potential Persistence Via Shim Database Modification | medium | windows / registry_set |
| Potential Shim Database Persistence via Sdbinst.EXE | medium | windows / process_creation |
| Uncommon Extension Shim Database Installation Via Sdbinst.EXE | medium | windows / process_creation |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Registry Keys for Creating SHIM Databases | TTP | NULL | Sysmon EventID 13 |
| Shim Database File Creation | TTP | NULL | Sysmon EventID 11 |
| Shim Database Installation With Suspicious Parameters | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
None recorded.
| Used by | Procedure example |
|---|---|
| MalwarePillowmint | Pillowmint has used a malicious shim database to maintain persistence. |
| MalwareSDBbot | SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe. |
| MalwareShimRat | ShimRat has installed shim databases in the |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
