Windows sdbinst.exe Installing Shim Database with Uncommon Extension
Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-01
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where the binary name indicates sdbinst.exe and the command line contains an uncommon .sdb usage pattern consistent with installing a shim database. Attackers may use shim databases to establish persistence and/or trigger execution of malicious behavior associated with application compatibility shims. The detection relies on Windows process creation telemetry, matching the sdbinst.exe executable and filtering out command-line patterns that the rule treats as likely legitimate.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- github.comhttps://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows sdbinst.exe Installing Shim Database with Uncommon Extension
id: af1fe022-0898-4a62-bcb9-4b4503dabcd7
related:
- id: 517490a7-115a-48c6-8862-1a481504d5a8
type: derived
- id: 18ee686c-38a3-4f65-9f44-48a077141f42
type: derived
status: test
description: This rule flags process executions where the binary name indicates sdbinst.exe and the command line contains an uncommon .sdb usage pattern consistent with installing a shim database. Attackers may use shim databases to establish persistence and/or trigger execution of malicious behavior associated with application compatibility shims. The detection relies on Windows process creation telemetry, matching the sdbinst.exe executable and filtering out command-line patterns that the rule treats as likely legitimate.
references:
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-01
modified: 2024-01-10
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1546.011
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \sdbinst.exe
- OriginalFileName: sdbinst.exe
filter_main_legit_ext:
CommandLine|contains: .sdb
filter_main_legit_extensions:
- CommandLine|endswith:
- " -c"
- " -f"
- " -mm"
- " -t"
- CommandLine|contains: " -m -bg"
filter_main_null:
CommandLine: null
filter_main_empty:
CommandLine: ""
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1