huntrule

Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll

Flags rundll32 command-line activity that flushes ShimCache via apphelp.dll or kernel32.dll entry points.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-02-01
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process creation events where rundll32 is invoked to flush the local ShimCache using specific AppCompat/compatibility DLL entry points and numeric parameters. Attackers may use this behavior to impair defenses and hinder forensic recovery by removing cached compatibility/shim artifacts. The detection relies on command-line telemetry from process creation, matching required rundll32, DLL, method names, and the corresponding parameters.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange
Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837
Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware
Malicious Service DLL Hijack for Persistence via Lotus Blossom
Suspicious Loopback Proxy Server Configured via Registry (via registry_set)
Malicious WDigest Credential Caching Enabled via Registry (via registry_set)
Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm
Malicious Gh0stBins RAT Registry Marker HHClient
Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)
Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)
Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll
Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.