Sdbinst - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/sdbinst/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 03:04:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWindows Sdbinst.exe Shim Database Installation with Non-Standard Extensionshttps://feed.craftedsignal.io/briefs/2026-11-sdbinst-shim-persistence/Tue, 10 Nov 2026 03:04:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sdbinst-shim-persistence/Adversaries may use sdbinst.exe to install shim databases with uncommon file extensions to establish persistence or elevate privileges.<p>The Windows Shim Database Installer (sdbinst.exe) is a utility used to install custom shim databases. Adversaries may use this tool to establish persistence or elevate privileges by executing malicious content triggered by application shims. Detection logic identifies the execution of sdbinst.exe when used with files lacking the standard .sdb extension, which may indicate the installation of a suspicious shim database.</p> mediumadvisorypersistenceprivilege-escalationwindowssdbinst