huntrule

Windows sdbinst.exe Installing Shim Database with Uncommon Extension

Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.

FreeUnreviewedSigmamediumv1
title: Windows sdbinst.exe Installing Shim Database with Uncommon Extension
id: af1fe022-0898-4a62-bcb9-4b4503dabcd7
related:
  - id: 517490a7-115a-48c6-8862-1a481504d5a8
    type: derived
  - id: 18ee686c-38a3-4f65-9f44-48a077141f42
    type: derived
status: test
description: This rule flags process executions where the binary name indicates sdbinst.exe and the command line contains an uncommon .sdb usage pattern consistent with installing a shim database. Attackers may use shim databases to establish persistence and/or trigger execution of malicious behavior associated with application compatibility shims. The detection relies on Windows process creation telemetry, matching the sdbinst.exe executable and filtering out command-line patterns that the rule treats as likely legitimate.
references:
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  - https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-01
modified: 2024-01-10
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \sdbinst.exe
    - OriginalFileName: sdbinst.exe
  filter_main_legit_ext:
    CommandLine|contains: .sdb
  filter_main_legit_extensions:
    - CommandLine|endswith:
        - " -c"
        - " -f"
        - " -mm"
        - " -t"
    - CommandLine|contains: " -m -bg"
  filter_main_null:
    CommandLine: null
  filter_main_empty:
    CommandLine: ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags process executions where the binary name indicates sdbinst.exe and the command line contains an uncommon .sdb usage pattern consistent with installing a shim database. Attackers may use shim databases to establish persistence and/or trigger execution of malicious behavior associated with application compatibility shims. The detection relies on Windows process creation telemetry, matching the sdbinst.exe executable and filtering out command-line patterns that the rule treats as likely legitimate.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.