Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll

title: "Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll"
id: 0288087e-d8ac-4d79-80e1-7f0d9adac6b5
status: stable
description: This rule identifies Windows process creation events where rundll32 is invoked to flush the local ShimCache using specific AppCompat/compatibility DLL entry points and numeric parameters. Attackers may use this behavior to impair defenses and hinder forensic recovery by removing cached compatibility/shim artifacts. The detection relies on command-line telemetry from process creation, matching required rundll32, DLL, method names, and the corresponding parameters.
references:
  - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-02-01
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection1a:
    CommandLine|contains|all:
      - rundll32
      - apphelp.dll
  selection1b:
    CommandLine|contains:
      - ShimFlushCache
      - "#250"
  selection2a:
    CommandLine|contains|all:
      - rundll32
      - kernel32.dll
  selection2b:
    CommandLine|contains:
      - BaseFlushAppcompatCache
      - "#46"
  condition: ( selection1a and selection1b ) or ( selection2a and selection2b )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b0524451-19af-4efa-a46f-562a977f792e
    type: derived