1200KM / detection
T1546.011 Application Shimming — Detection Rules
Detection workspace for T1546.011 Application Shimming: 6 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Potential Shim Database Persistence via Sdbinst.EXE · test · medium · {"category":"process_creation","product":"windows"}
- Uncommon Extension Shim Database Installation Via Sdbinst.EXE · test · medium · {"category":"process_creation","product":"windows"}
- Potential Persistence Via AppCompat RegisterAppRestart Layer · test · medium · {"category":"registry_set","product":"windows"}
- Potential Persistence Via Shim Database Modification · test · medium · {"category":"registry_set","product":"windows"}
- Suspicious Shim Database Patching Activity · test · high · {"category":"registry_set","product":"windows"}
- Potential Persistence Via Shim Database In Uncommon Location · test · high · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0017 Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)
AN0051 Analytic 0051
Correlated modification of AppCompat registry keys and execution of sdbinst.exe to install custom shim databases. Followed by DLL injection via shim behavior into target application processes.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1546.011 simulation workspace
- File Creation · DC0039
- Module Load · DC0016
- Process Creation · DC0032
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.