Abuse of Application Compatibility Shim Databases for Persistence

The Windows Application Compatibility (AppCompat) framework is designed to allow legacy applications to function correctly on newer versions of the Windows operating system. This framework utilizes Shim Database (.sdb) files to apply compatibility fixes or patches to specific processes. Threat actors have been observed abusing this functionality to gain persistence and execute arbitrary code by installing custom, malicious shim databases. Once registered in the Windows Registry, these databases can force the loading of malicious code into legitimate processes whenever they are executed. This technique is particularly effective as it operates at the system level and can be used to achieve stealthy, persistent execution. Defenders should monitor registry modifications within the AppCompatFlags subtree to detect the registration of unauthorized .sdb files.

Impact

Successful abuse of Application Compatibility Shim databases allows attackers to achieve persistent execution with the privileges of the host process, potentially leading to unauthorized access, privilege escalation, or data exfiltration. This technique can be applied across various Windows environments, and its stealthy nature makes it a valuable persistence mechanism for threat actors seeking to maintain long-term access to compromised systems.

Recommendation

• Deploy the provided Sigma rule to monitor registry modifications within the 'AppCompatFlags\Custom' registry key for the creation or modification of .sdb entries.
• Establish a baseline of legitimate shim database registrations within the environment to reduce false positives.
• Investigate any registry modification events originating from unknown or unsigned processes that target 'AppCompatFlags\Custom'.
• Regularly audit system registry paths associated with 'AppCompatFlags' to identify and remove unauthorized or suspicious .sdb entries.