T1546.011PersistencePrivilege Escalation
Application Shimming
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1546.011Application ShimmingT1546.0116 general rules
- Potential Persistence Via Shim Database In Uncommon Locationhightest
- Suspicious Shim Database Patching Activityhightest
- Potential Persistence Via AppCompat RegisterAppRestart Layermediumtest
- Potential Persistence Via Shim Database Modificationmediumtest
- Potential Shim Database Persistence via Sdbinst.EXEmediumtest
- Uncommon Extension Shim Database Installation Via Sdbinst.EXEmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Application Shimming
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.