Windows Shim Database Persistence via sdbinst.exe with .sdb Payload

Alerts when sdbinst.exe runs and references a .sdb shim database, indicating potential shim-based persistence.

FreeUnreviewedSigmamediumv1

windows-shim-database-persistence-via-sdbinst-exe-with-sdb-payload-517490a7

title: Windows Shim Database Persistence via sdbinst.exe with .sdb Payload
id: e67dbd0f-9bf1-41b7-a26d-940516a20a6c
related:
  - id: 18ee686c-38a3-4f65-9f44-48a077141f42
    type: similar
  - id: 517490a7-115a-48c6-8862-1a481504d5a8
    type: derived
status: test
description: This rule flags Windows process creation where sdbinst.exe is executed with a command line containing a .sdb shim database file. Installing a new shim database can help an attacker establish persistence and potentially enable privilege escalation by loading malicious shim behavior. The detection relies on process creation telemetry, including the executable path/name and the command line content.
references:
  - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml
author: Markus Neis, Huntrule Team
date: 2019-01-16
modified: 2023-12-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \sdbinst.exe
    - OriginalFileName: sdbinst.exe
  selection_cli:
    CommandLine|contains: .sdb
  filter_optional_iis:
    ParentImage|endswith: \msiexec.exe
    CommandLine|contains:
      - :\Program Files (x86)\IIS Express\iisexpressshim.sdb
      - :\Program Files\IIS Express\iisexpressshim.sdb
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation where sdbinst.exe is executed with a command line containing a .sdb shim database file. Installing a new shim database can help an attacker establish persistence and potentially enable privilege escalation by loading malicious shim behavior. The detection relies on process creation telemetry, including the executable path/name and the command line content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.