{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/sdbinst/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["persistence","privilege-escalation","windows","sdbinst"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Windows Shim Database Installer (sdbinst.exe) is a utility used to install custom shim databases. Adversaries may use this tool to establish persistence or elevate privileges by executing malicious content triggered by application shims. Detection logic identifies the execution of sdbinst.exe when used with files lacking the standard .sdb extension, which may indicate the installation of a suspicious shim database.\u003c/p\u003e\n","date_modified":"2026-11-10T03:04:03Z","date_published":"2026-11-10T03:04:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sdbinst-shim-persistence/","summary":"Adversaries may use sdbinst.exe to install shim databases with uncommon file extensions to establish persistence or elevate privileges.","title":"Windows Sdbinst.exe Shim Database Installation with Non-Standard Extensions","url":"https://feed.craftedsignal.io/briefs/2026-11-sdbinst-shim-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Sdbinst","version":"https://jsonfeed.org/version/1.1"}