{"id":"18ee686c-38a3-4f65-9f44-48a077141f42","title":"Uncommon Extension Shim Database Installation Via Sdbinst.EXE","description":"Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-01","modified":"2024-01-10","tags":["attack.persistence","attack.privilege-escalation","attack.t1546.011"],"technique_ids":["T1546.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html","https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md"],"source_path":"rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml","source_sha256":"f359e23ab00ebfe4eb51a157c4792cbe1eef1f13839ffcb588f193a02dbb7c50","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon Extension Shim Database Installation Via Sdbinst.EXE\nid: 18ee686c-38a3-4f65-9f44-48a077141f42\nrelated:\n    - id: 517490a7-115a-48c6-8862-1a481504d5a8\n      type: derived\nstatus: test\ndescription: |\n    Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.\n    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\nreferences:\n    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html\n    - https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-08-01\nmodified: 2024-01-10\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1546.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\sdbinst.exe'\n        - OriginalFileName: 'sdbinst.exe'\n    filter_main_legit_ext:\n        CommandLine|contains: '.sdb'\n    filter_main_legit_extensions:\n        # ParentImage|endswith: ':\\Windows\\System32\\svchost.exe'\n        - CommandLine|endswith:\n              - ' -c'\n              - ' -f'\n              - ' -mm'\n              - ' -t'\n        - CommandLine|contains: ' -m -bg'\n    filter_main_null:\n        CommandLine: null\n    filter_main_empty:\n        CommandLine: ''\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","page":"techniques/enterprise/T1546.011/"}],"data_path":"data/detection-rules/18ee686c-38a3-4f65-9f44-48a077141f42.json","kind":"sigma"}