Windows Registry Modification of Application Shim Database (InstalledSDB/Custom) for Persistence
Alerts on registry changes to Windows AppCompatFlags InstalledSDB/Custom that may enable shim-based persistence.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-30
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry writes under the Application Compatibility/AppCompatFlags paths used for shim database configuration, specifically entries under InstalledSDB and Custom. Attackers may abuse these shim mechanisms to trigger execution of malicious content and maintain access or gain elevated privileges. Detection relies on registry set events capturing TargetObject paths that contain the specified AppCompatFlags subkeys, while excluding records with empty or null Details fields.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-3---registry-key-creation-andor-modification-events-for-sdb
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- andreafortuna.orghttps://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Modification of Application Shim Database (InstalledSDB/Custom) for Persistence
id: 5a640a07-5fda-4f7f-9dbb-faf982553169
status: test
description: This rule flags Windows registry writes under the Application Compatibility/AppCompatFlags paths used for shim database configuration, specifically entries under InstalledSDB and Custom. Attackers may abuse these shim mechanisms to trigger execution of malicious content and maintain access or gain elevated privileges. Detection relies on registry set events capturing TargetObject paths that contain the specified AppCompatFlags subkeys, while excluding records with empty or null Details fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-3---registry-key-creation-andor-modification-events-for-sdb
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml
author: frack113, Huntrule Team
date: 2021-12-30
modified: 2025-10-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.011
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\
- \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\
filter_main_empty_string:
Details: ""
filter_main_empty_value:
Details: (Empty)
filter_main_null:
Details: null
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate custom SHIM installations will also trigger this rule
level: medium
license: DRL-1.1
related:
- id: dfb5b4e8-91d0-4291-b40a-e3b0d3942c45
type: derived