Windows File Creation: New Custom AppPatch Shim Database Files Created

title: "Windows File Creation: New Custom AppPatch Shim Database Files Created"
id: c78a8c0d-ca2d-407e-add9-97cc6b76cd6c
status: test
description: This rule identifies creation of custom Windows Application Shim database files under the AppPatch custom and CustomSDB directories. Attackers can use Application Shims to persist across reboots and potentially elevate privileges by triggering malicious behavior through shim loading. It relies on Windows file creation telemetry matching target paths containing the specified directory locations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory
  - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
  - https://liberty-shell.com/sec/2020/02/25/shim-persistence/
  - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-29
modified: 2023-12-06
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.009
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - :\Windows\apppatch\Custom\
      - :\Windows\apppatch\CustomSDB\
  condition: selection
falsepositives:
  - Legitimate custom SHIM installations will also trigger this rule
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_new_shim_database/info.yml
license: DRL-1.1
related:
  - id: ee63c85c-6d51-4d12-ad09-04e25877a947
    type: derived