Windows File Creation: Custom Application Shim Database Files Created
Flags creation of custom Application Shim database files in AppPatch custom directories on Windows.
- Product
- windows
- Category
- file_event
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-29
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation of custom Windows Application Compatibility Framework (Application Shim) database files in the default shim database directories. Attackers may use shim-based execution to persist and/or elevate privileges by triggering malicious content via application shimming. Detection relies on Windows file creation telemetry identifying newly created files whose paths contain the specified Custom and CustomSDB directories.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory
- mandiant.comhttps://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- liberty-shell.comhttps://liberty-shell.com/sec/2020/02/25/shim-persistence/
- andreafortuna.orghttps://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Creation: Custom Application Shim Database Files Created"
id: c78a8c0d-ca2d-407e-add9-97cc6b76cd6c
status: test
description: This rule flags the creation of custom Windows Application Compatibility Framework (Application Shim) database files in the default shim database directories. Attackers may use shim-based execution to persist and/or elevate privileges by triggering malicious content via application shimming. Detection relies on Windows file creation telemetry identifying newly created files whose paths contain the specified Custom and CustomSDB directories.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- https://liberty-shell.com/sec/2020/02/25/shim-persistence/
- https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-29
modified: 2023-12-06
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.009
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains:
- :\Windows\apppatch\Custom\
- :\Windows\apppatch\CustomSDB\
condition: selection
falsepositives:
- Legitimate custom SHIM installations will also trigger this rule
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/info.yml
license: DRL-1.1
related:
- id: ee63c85c-6d51-4d12-ad09-04e25877a947
type: derived