huntrule

Windows Shim Database Persistence via sdbinst.exe with .sdb Payload

Alerts when sdbinst.exe runs and references a .sdb shim database, indicating potential shim-based persistence.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Markus Neis (SigmaHQ), DRL 1.1
Published
2019-01-16
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation where sdbinst.exe is executed with a command line containing a .sdb shim database file. Installing a new shim database can help an attacker establish persistence and potentially enable privilege escalation by loading malicious shim behavior. The detection relies on process creation telemetry, including the executable path/name and the command line content.

Reporting behind it

Related detections7 linkedT1546.011 — drag to rearrange
Suspicious Application Shim Database Registration via Registry Set
Suspicious Application Shim Database Installation via sdbinst
Windows Registry Persistence via AppCompatFlags Layers REGISTERAPPRESTART
Windows sdbinst.exe Installing Shim Database with Uncommon Extension
Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path
Windows Registry: New AppCompatFlags custom shim databases targeting system processes
Windows Registry Modification of Application Shim Database (InstalledSDB/Custom) for Persistence
Windows Shim Database Persistence via sdbinst.exe with .sdb Payload
Pivot detection · T1546.011 · 7 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.