Techniques › T1546.011 › AN0051
AN0051 Analytic 0051
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlated modification of AppCompat registry keys and execution of sdbinst.exe to install custom shim databases. Followed by DLL injection via shim behavior into target application processes.</p>
- Detects
- T1546.011 Application Shimming
- Part of
- DET0017 Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CustomShimPathAllowlist | Filter out known-good .sdb paths in AppPatch\Custom folders |
TimeWindow | Tunable window for correlating registry modification and sdbinst.exe execution |
DLLInjectionTarget | Expected target applications or binaries for injected DLLs |
UserContext | Limit alerting to admin or SYSTEM-context initiated shim installations |
ShimCommandLinePattern | Expected or benign sdbinst.exe command-line patterns to exclude |