{"id":"517490a7-115a-48c6-8862-1a481504d5a8","title":"Potential Shim Database Persistence via Sdbinst.EXE","description":"Detects installation of a new shim using sdbinst.exe.\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\n","author":"Markus Neis","status":"test","level":"medium","date":"2019-01-16","modified":"2023-12-06","tags":["attack.persistence","attack.privilege-escalation","attack.t1546.011"],"technique_ids":["T1546.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence"],"source_path":"rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml","source_sha256":"beb7975c32d8706586b4f9b7a1ae1069e45d1b55f9d44165ccc89cdfc0c23005","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Shim Database Persistence via Sdbinst.EXE\nid: 517490a7-115a-48c6-8862-1a481504d5a8\nrelated:\n    - id: 18ee686c-38a3-4f65-9f44-48a077141f42\n      type: similar\nstatus: test\ndescription: |\n    Detects installation of a new shim using sdbinst.exe.\n    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims\nreferences:\n    - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence\nauthor: Markus Neis\ndate: 2019-01-16\nmodified: 2023-12-06\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1546.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\sdbinst.exe'\n        - OriginalFileName: 'sdbinst.exe'\n    selection_cli:\n        CommandLine|contains: '.sdb'\n    filter_optional_iis:\n        ParentImage|endswith: '\\msiexec.exe'\n        CommandLine|contains:\n            # Expected behavior for IIS Express (e.g. https://www.hybrid-analysis.com/sample/15d4ff941f77f7bdfc9dfb2399b7b952a0a2c860976ef3e835998ff4796e5e91?environmentId=120)\n            - ':\\Program Files (x86)\\IIS Express\\iisexpressshim.sdb'\n            - ':\\Program Files\\IIS Express\\iisexpressshim.sdb'\n    condition: all of selection_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","page":"techniques/enterprise/T1546.011/"}],"data_path":"data/detection-rules/517490a7-115a-48c6-8862-1a481504d5a8.json","kind":"sigma"}