Tag
Attackers utilize the Windows Application Compatibility Shim (AppCompat) mechanism to achieve persistence and arbitrary code execution by registering malicious shim databases.