Windows Sdbinst.exe Shim Database Installation with Non-Standard Extensions
Adversaries may use sdbinst.exe to install shim databases with uncommon file extensions to establish persistence or elevate privileges.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 03:04 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The Windows Shim Database Installer (sdbinst.exe) is a utility used to install custom shim databases. Adversaries may use this tool to establish persistence or elevate privileges by executing malicious content triggered by application shims. Detection logic identifies the execution of sdbinst.exe when used with files lacking the standard .sdb extension, which may indicate the installation of a suspicious shim database.
Detection coverage 1
Detect Uncommon Extension Shim Database Installation
mediumDetects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Detection queries are available on the platform. Get full rules →