Skip to content
Threat Feed
Subscribe
high threat

Suspicious Shim Database Installation

Adversaries, including the threat actor FIN7, have been observed using the Application Compatibility Shim database to achieve persistence and facilitate process injection by patching sensitive system binaries.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 10, 03:09 UTC
Detection
1 rule
Source quality
A1Likely

The Application Compatibility Shim infrastructure can be abused to inject code or maintain persistence by hooking system binaries. Actors modify the registry under the AppCompatFlags path to force the Windows Compatibility Manager to load malicious shim databases (.sdb files) when specific system processes are executed.

Attack Chain

  1. Attacker crafts a malicious Shim Database (.sdb) file.
  2. Attacker installs the shim database using the sdbinst.exe utility.
  3. The shim database installation registers the malicious DLL in the Windows Registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\.
  4. The Windows Compatibility Manager detects the Shim registry entry for the targeted system process.
  5. Upon process execution, the Shim engine injects the defined hooks or patches into the target process memory space.
  6. Malicious code is executed within the context of the target system process.

Recommendation

  • Deploy the provided Sigma rule to monitor registry modifications within the AppCompatFlags\Custom subkeys.
  • Audit existing installed Shim Databases using the sdbinst.exe -q -l command to identify unauthorized or unknown databases.
  • Restrict the ability to install new Shim Databases to authorized administrative accounts and known-good software deployment tools.

Immediate actions

Deploy the Shim Database registry monitoring rule to production SIEM

Detection Engineering 24h

Threat Hunt

Identify all shim databases installed on critical workstations

T1546.011 medium high confidence hunt now

Data: Command line execution: sdbinst.exe -l

Mitigations

Implement application control or restriction policies to prevent sdbinst.exe execution by non-privileged users

medium IT Operations

T1546.011

Detection coverage 1

Detect Suspicious Shim Database Patching

high

Detects the installation of a new Shim Database targeting core Windows system processes, a technique associated with persistence and process injection.

sigma tactics: persistence, privilege-escalation techniques: T1546.011 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →